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1. INTRODUCTION 


The space shuttle represents a pioneering effort 
in avionics history. Its primary goals are to provide 
low-cost transportation to and from earth orbit and 
to offer a platform for conducting experiments in space. 

It v/i1l also enable deployment and recovery of free flying 
or automated satellites. The shuttle complex is controlled 
by a Digital Processing Subsystem (DPS)* which consists of 
five identical general-purpose digital computers, each 
capable of controlling and/or communicating with other 
shuttle subsystems such as Main Propulsion; Reaction Con- 
trol; Guidance, Navigation and Control; Flight Instrumenta- 
tion. The DPS is intende^d to satisfy the stringent reli- 
ability requirements imposed by the space mission and its 
design ensures fail-safe and fail-soft performance. 

Figure 1 shows a block diagram of the space shuttle 
avionics system. The five computer systems, GPCl through 
GPC 5, comprise the DPS and control the other avionic sub- 
systems through twenty-eight data-bus channels. Each GPC 
consists of a CPU and an lOP; the CPU performs mainly com- 
putation whereas the lOP is responsible for interfacing the 
CPU v/ith the bus channels. The GPCs communicate their status 
or mode of computation to each other through signals on 40 
input and 32 output lOP discretes [2]. These discretes are 
of principal interest to this investigation. An analysis 
was conducted to determine the impact a fault on these 
discretes may have on system performance in terms of re- 
liability and fail -safeness. The propagation of hardware 
discrete faults into software and applications program logic 
was traced and recommendations were developed to curtail the 
propagation as soon as possible and to minimize any adverse 
consequences . 

The following items were accomplished by W. W. Gaertner 
Research, Inc. during its contract with NASA-JSC. 

1) Identification and functional description of 
lOP discretes. 

2) Identification of operating system (FCOS) modules 
that use lOP discretes and the manner of usage. 

3) Analysis of the effects of faults on lOP discretes 
in terms of system degradation (e.g., loss of a 
GPC from the redundant set). 

4) Determination of the time that may elapse before 
a fault on lOP discretes is detected. 

5) Recommendations to prevent/detect faults on lOP 
discretes and suggestions for future research. 


* A List of Acronyms is attached to this report. 
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The organization of the report is as follows. 

Chapter 2 is exclusively devoted to item (1). Items (2), 
(3) and (4) are treated in detail in Chapter 3. Chapter 
4 discusses probabilistic aspects of lOP discrete fault 
occurrences and presents an assessment of system failure 
rate. In Chapter 5 methods of prevention/detection of 
lOP discrete faults and recommendations are made that 
may be incorporated into system hardware/software to im- 
prove mission reliability. Chapter 6 presents methods 
of recovering GPCs Tost because of non-synchronization 
during OFT phase. This chapter also discusses alterna- 
tive approaches to the design of redundant avionic com- 
puter systems and future work. 

The initial phase of this Contract was monitored by 
Mr. Curtis D. Vlarnick and the final phase by Mr. Allen E. 
Brandli, both of NASA-JSC, Houston, Texas. They were ex- 
tremely helpful in procuring technical documents on the 
space shuttle and arranging conferences with appropriate 
technical personnel. Discussions with the following 
individuals were beneficial in gaining insight into the 
space shuttle data processing: Messrs. Charles Floyd, 

Sam Ankney and Ed Dalke of NASA-JSC; and Jerry Johnson 
and Vic Harrison of Rockwell International Space Division. 
This report was prepared with the assistance of Mona G. 
Adams, Marilyn B. Kommritz and Marianne P. Gaertner. 


2. FUNCTIONAL DESCRIPTION OF lOP DISCRETES 


In this chapter each lOP discrete is identified in 
terms of the label of specification used in System Level 
Description, Hardware, CPDS, Volume 1, Book 1 [3] and the 
lOP pin numbers used in the actual hardware construction 
of the lOPs [4], This allows traceability of lOP discretes 
from their functional specifications to their physical loca- 
tions, a feature useful for trouble-shooting and design al- 
terations. Then the function for which each lOP discrete is 
intended is described. This functional description gives an 
overview of the important and critical role played by the 
discretes in the overall data and control management. 

The lOP discretes of a GPC serve one of the following 
functions : 

(a) Local control and status indication of the GPC, 

(b) Synchronization status communication to other 
GPCs, and 

(c) Redundancy management. 

The discretes that perform .function (a) issue commands such 
as halt, standby, run and IPL initiate and indicate the mode 
of the GPC, e.g,, halt, standby and IPL-in-progress . The 
discretes assigned to function (b) are vital to synchronous 
performance of the GPCs. They indicate whether a particular 
GPC is in a redundant set and enable synchronization of GPCs 
after I/O transactions, supervisory calls and timer interrupts. 
Discretes that perform (c) are used to indicate the assessment 
of each GPC regarding the functional behavior of other GPCs. 
Voting logic is incorporated in these discretes to decide 
whether a particular GPC is functioning correctly. 

As may be noted, discretes performing (b) and (c) are 
not needed if the GPC is intended to be operated alone as 
a backup flight control system. Accordingly the discretes 
for GPC 5 are wired differently from the others. In Table 
IIOP discretes are shown for GPCs 1 to 4 with their labels, 
pin numbers, functional identifications, sources and destina- 
tions. Table 2 shows the discretes for GPC 5. 
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LABEL 

lOP PINS 

FUNCTION 

IDENTIFICATION 

I/O 

FROM/TO 

D030 

03-57,58 

GPC 

ID source 

output 

lOP N 

DI32 

03-74,75 

GPC 

ID bit 0 (binary 1) 

input 

lOP N 

DI33 

03-116,123 

GPC 

ID bit 1 (binary 2) 

input 

lOP N 

DI34 

03-107,122 

GPC ID bit 2 (binary 4) 
REDUNDANCY MANAGEMENT 

input 

lOP N 

DRI03 

05-36,37 

GPC 

N+i fail vote in 

input 

TOP N+1 

DRI04 

05-35,47 

GPC 

N+2 fail vote in 

input 

lOP N+2 

DRI05 

05-33,34 

GPC 

N+3 fail vote in 

input 

lOP N+3 

DROOO 

05-46,58 

GPC 

fail indicator 

output 

panels 

DR007 

05-44,45 

GPC 

N+1 fail vote out 

output 

lOP N+1 

DR008 

05-42,43 

GPC 

N+2 fail vote out 

output 

lOP N+2 

DR009 

05-40,41 

GPC N+3 fail vote out 
SYNCHRONIZATION 

output 

lOP N+3 

DI20 

03-80,91 

GPC 

N+1 sync bit 1 

input 

I OP N+1 

DI21 

03-92,104 

GPC 

N+2 sync bit 1 

input 

lOP N+2 

DI22 

03-103,114 

GPC 

N+3 sync bit 1 

input- 

10 P N+3 

DI24 

03-113,121 

GPC 

N+1 sync bit 2 

input 

lOP N+1 

DI25 

03-112,128 

GPC 

N+2 sync bit 2 

input 

lOP N+2 

DI26 

03-101,111 

GPC 

N+3 sync bit 2 

input 

I OP N+3 

DI28 

03-119,126 

GPC 

N+1 sync bit 3 

input 

lOP N+1 

DI29 

03-99,109 

GPC 

N+2 sync bit 3 

input 

lOP N+2 

DI30 

03-118,125 

GPC 

N+3 sync bit 3 

input 

lOP N+3 

D020 

03—43 ,44 

GPC 

N sync bit 1 

output 

3 lOPs 

D024 

03-34,35 

GPC 

N sync bit 2 

output 

3 lOPs 

D028 

03-46,47 

GPC N sync bit 3 

CONTROLS AND INDICATORS 

output 

3 lOPs 

D007 

03-36,48 

I/O 

active indicator 

output 

panel 

D009 

03-25,37 

GPC 

ready indicator 

output 

panel 

D031 

03-67,68 

GPC 

IPL indicator 

output 

panel 

DIOO 

05-1,2 

GPC 

halt command 

input 

panel 

DIOl 

05-3,4 

GPC 

standby command 

input 

panel 

DI02 

05-5,6 

GPC 

run command 

input 

panel 

DI03 

05-7, '4 

GPC 

IPL activate command 

input 

panel 

DI04 

05-8,9 

MMl 

IPL select command 

input 

panel 

DIOS 

05-10,11 

MM2 

IPL select command 

input 

panel 

DI12 

05-25,26 

I/O 

terminate command A 

input 

panel 

DI13 

05-27,28 

I/O 

terminate command B, 

BFCS input 

panel 

EXCIT 

03-110 

+ 5 

volts 

output 

panel s 

S 

03-100 

Signal return 
MASS MEMORY 

output 

panels 

D012 

03-8,16 

MMl 

reset 

output 

MMl 

D013 

03-17,27 

MM2 

reset 

output 

MM2 

DIOS 

05-12,13 

MMl 

ready 

input 

MMl 

DI07 

05-15,16 

MM2 

ready 

BFCS 

input 

MM2 

Dill 

05.-23,24 

BFCS engage command 

input 

BFCS 


Table 1. lOP Discretes for GPC N (Orbiter 101, GPC 1-4) 


Note: GPC N+i indicates GPC N+i (mod 4) 

b' 



LABEL 

TOP PINS 

FUNCTION IDENTIFICATION 

I/O 

FROM/TO 

D030 

03-57,58 

GPC ID source 

output 

lOP 5 

DI32 

03-74,75 

GPC ID bit 0 (binary 1) 

input 

lOP 5 

DI33 

03-116,123 

GPC ID bit 1 (binary 2) 

input 

lOP 5 

DI34 

03-107,122 

GPC ID bit 2 (binary 4) 
REDUNDANCY MANAGEMENT 

input 

lOP 5 

DROOO 

05-46,58 

GPC fail indicator 
CONTROLS AND INDICATORS 

output 

panel s 

D009 

03-25,37 

GPC ready indicator 

output 

panel 

DIOO 

05-1,2 

GPC halt command 

input 

panel 

DIOl 

05-3,4 

GPC standby command 

input 

panel 

DI02 

05-5,6 

GPC run command 

input 

panel 

EXCIT 

03-110 

+ 5 volts 

output 

panels 

S 

03-100 

Signal return 
BFCS 

output 

panels 

DI13 

05-27.28 

I/O terminate command B 

inverse input 

BFCS 

Dill 

05-23,24 

BFCS engage command 

input 

BFCS 

DI15 

03-66,67 

BFCS engage command 

input 

BFCS 

DI16 

03-88,89 

BFCS engage command 

input 

BFCS 

D008 

03-61,62 

BFCS fail 

output 

BFCS 


Table 2. lOP Discretes (Or'i>iter 101, GPG 5) 
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In the follovnng, the primary function of each discrete 
is described in detail- The above functional classification is 
used to clarify its role. 

2.1 Identification Discretes 

Each computer contains three ID discrete inputs, which are 
used to allow the computer to determine the position in which it 
has been installed. The 3-bit binary code which identifies each 
computer position is formed by wiring the constant differential 
output of the ID Source line driver to each ID input bit with 
the appropriate polarity. , For example, the computer in Forward 
Avionics Bay III is GPC 3,' so the connector for lOP J3 at that 
position must have ID bits 0 and 1 wired directly to the ID Source 
and ID bit 2 wired to the ID Source with inverted polarity. The 
connections between the ID Source differential output and the 
three ID differential inputs are as follows [4]: 


LOCATION 

COMPUTER 

ID BIT 2 

ID BIT 1 

ID BIT 0 

Forward Avionics 
Bay I 

GPC 1 
GPC 4 

inverted 

direct 

inverted 

inverted 

di rect 
inverted 

Forward Avionics 
Bay II 

GPC 2 
GPC 5 

inverted 

direct 

direct 

inverted 

inverted 

direct 

Forward Avionics 
Bay III 

GPC 3 

inverted 

di rect 

direct 


The identification discretes serve function (a) and are 
primarily used in the initialization routine. In this routine 
the GPC number is read from the discretes and stored in internal 
software tables (Compool and CVT) and thereafter these tables 
are consulted for GPC identification numbers. The identifica- 
tion numbers are used to select the prime computer system as 
well as to track the GPCs that failed to synchronize in a re- 
dundant set, 

2.2 Redundancy Management Discretes 

Three input and four output discretes are assigned to the 
redundancy management function. Signals on three of the output 
discretes (DR007, 08, 09) are issued from one GPC to other GPCs 
to indicate failure votes, A failure vote is issued under soft- 
v/are control by one GPC to another when there is a mismatch be- 
tween their computed results. The fourth output discrete (DROOQ) 
is a GPC fail indicator. 


It indicates that the GPC has detected a BITE self-test 
failure or has been voted out of the GPC voting set. The 
signal is automatically issued upon lOP hardware detection 
of two or more failure votes from other lOPs of the voting 
set, expiration of the watchdog timer, or detection of GPC 
self-test failure (providing these functions have been enabled 
or initiated by GPC software). It should be noted that the CPU 
is not reset upon GPC/IOP failure determination, and CPU instruc- 
tion execution is still possible after a GPC failure. The TOP 
hardware reset of all GPC outputs, however, prevents the GPC 
from participating in the control of the Space Shuttle vehicle, 

t 

The GPC fail indicator output signal from each GPC termi- 
nates at two units: a 5-by-5 computer (failure) status display 

matrix, and the caution/warning electronics unit. In addition, 
at the 5-by-5 display, the GPC fail indicators are amplified 
and sent to operational instrumentation where they are sampled 
for downlink transmission. 

The caution/warning electronics unit accepts the GPC fail 
indicator signals and retransmits them to a caution/warning 
status display (120 indicators). The GPC fail indicator sig- 
nal from ea'ch GPC may be monitored at this display. The elec- 
tronic unit also transmits the logical OR of all five GPC fail 
indicator signals to the caution/warning annunciator display 
where a single light is turned on. When this signal is issued, 
it is accompanied by an audible alarm that remains on until 
manually reset from either of two master alarm reset switches 
located at the forward station. 

The 5-by-5 computer (failure) status display is driven by 
all five redundancy management output signals from each lOP (four 
failure votes and one failed condition). Since there are five 
GPCs, there are a total of 25 indicators. The GPC fail indicator 
for a given GPC lies along the matrix diagonal from the upper left 
to the lov^er right. All other indicators represent fail votes. 

The 5-by-5 display matrix allows visual observation of the fail- 
ure status of all five GPCs [2]. 

The redundancy management function is invoked after every 
SSIP cycle at forty millisecond intervals. The GPCs transfer 
data to each other on Inter-Computer Communication (ICC) bus 
units so that they can compare and vote on each other. 
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2.3 Synchronization Discretes 

These discretes convey the status of GPCs to each 
other so that they can be run in synchrony. Each GPC 
has three output discretes v/hich indicate its synchroniza- 
tion status. Table 3 gives the synchronization codes used 
In the space shuttle complex. Logic Os bn all the output 
discretes Indicate that the GPC is not operative and does 
not participate in computation or control. The I/O codes 
(010 and Oil) indicate that the GPC completed Its I/O 
transactions with or without encountering errors In data 
transmission. The timer a'nd SVC interrupts Indicate that 
the GPC was interrupted by a time-out indication from one 
of its timers and by supervisory call from an applicatlQn 
or FCOS program respectively. SSIP synchronization code 
is used to synchroni ze the -GPCs In the common set at every 
SSIP cycle. Logic Is on the output discretes indicate 
that the GPC is either running or expecting other GPCs to 
synchroni ze. 

The synclironizatlon discretes are used quite often 
(at rates of approximately 300 tImes/sec) and the manner in 
which they are used depends to a large extent on the appli- 
cation programmer. 

SYNCHRONIZATION CODES [5] 

Number Binary Meaning 


0 

1 

2 

3 

4 

5 

6 
7 


000 

Hal t/Off/Fail ed 


001 

Spare 


010 

I/O Complete, with error (IP 

oil 

I/O Complete, no error 

(IOC) 

100 

SSIP sync (common set) 


101 

Timer Interrupt 


110 

SVC Interrupt 


111 

Null/Run 



Table 3 
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2.4 Control and Indicator Discretes 

These discretes are primarily used to control and indicate 
the status of the GPC they are associated with. They perform 
function (a) and play a critical part in interfacing the GPC 
and the crev/- 

2.4.1 GPC Hal t/Standby/Run Command Discretes 

These discretes are controlled by a three-position toggle 
mode switch from Cockpit Panel 07. A separate switch is pro- 
vided for each GPC. ; 

Each switch provides three input signals (Halt, Standby* 
or Run) to the respective discrete. The three signals are 
interlocked in lOP hardware logic so that only one switch 
state is possible regardless of any switch bounce that is en- 
countered. For example, when the switch is moved from one 
position to another, the switch leaves the first position, 
encounters an open-circuit, and then makes contact at the 
second position. During the open-circuit transition, the 
previous switch state is maintained in hardware latches in 
the lOP. Open-circuit signals do not change the state of 
these latches. 

When the switch completes the open-circuit transition 
and finally makes contact at the next position, the new state 
is detected and stored by the interlocked latches. At this 
point, should switch bounce be encountered, producing momentary 
open-circuit conditions, the hardware latches guarantee that 
the switch state just established will be retained. The lOP 
logic thus guards against switch bounce. 

When the Halt Command discrete is set, an automatic reset 
of both the CPU and lOP is caused. In this reset state, normal 
macro instructions cannot be executed in the CPU and lOP; how- 
ever the GPC can support IPL, and Halt is the only state in 
which IPL can be performed. 

When the Standby discrete is set, the GPC is able to 
operate in an off-line mode, not synchronized to other GPCs. 

The Standby mode is identical to the Run mode except that it 
does not completely utilize the memory and configuration 
tables. In the Standby mode, application programs can be 
run, thus making it possible to test and diagnose system opera- 
tion- The GPC in Standby mode has less priority than a GPC in 
Run more in order to prevent lOP bus contentions when one or 
more GPCs are in Standby [6]. 



The Run mode is used during normal GPC operations. 
However, this mode can be overridden by software in 
which case the GPC Ready Talkback indicator will in- 
dicate barberpole rather than gray. 

2.4.2 GPC Ready Indicator Discrete 

This discrete drives a barberpol e/gray flag indicator 
to indicate the GPC status. When the discrete bit (D009) 
is set true, the indicator is driven to the gray position 
to indicate that the GPC is ready for normal processing. 

The IPL discrete can also drive this indicator to gray 
when IPL is in progress. ’The GPC 5 Ready indicator for 
ALT phase Indicates that backup flight control capability 
is resident and can be processed by engaging BFCS switch. 

When the discrete bit-is false, the indicator is driven 
to barberpole to indicate that the GPC is not ready. This 
indication is present when the GPC detects a hardware or 
software error. Some of the hardware detected errors are 
lOP timing fault, power supply failure/off, and parity 
errors vn’thin the CPU. Also a Halt mode and Command can 
cause this indication. 

2.4.3 GPC IPL and IPL Activate Discretes 

The GPC IPL discrete when true indicates that the GPC 
is performing IPL. The IPL Activate discrete is driven by 
a momentary pushbutton switch on the cockpit panel. Depres- 
sion of the switch sets the IPL Activate discrete true and 
causes IPL to be performed. The IPL discrete as mentioned 
before will drive the Ready talkback indicator gray to indi- 
cate IPL-i n-progress . The IPL Activate command will be 
effective only when the GPC is in a Halt state. 

2.4.4 I/O Active Indicator Discrete 

This discrete indicates the status of the GPC as to 
whether it can perform I/O on its data buses. A true out- 
put indicates that the GPC is ready to perform I/O after GPC 
initialization whereas a false output indicates either that 
the GPC is powered off or that the GPC, though powered on, 
is unable to perform I/O because of its lOP reset state or 
non completion of GPC initialization. 
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2.4.5 I/O Terminate Command Discretes 

There are two discretes assigned for I/O terminate 
function. The I/O Terminate Command A discrete is de- 
rived from one pole of a double-pole output terminate 
svntch on Panel 07. (The other pole issues the lOP 
Terminate Command B discrete). This Command causes 
immediate disable of four MIA transmitters for buses 
FC 1 through FC 4. The discrete input is always accom- 
panied by the lOP Terminate Command B discrete. 

The lOP Terminate Command B discrete is controlled 
by the second pole of the output terminate switch and 
when this command is received, eight MIA transmitters 
are immediately disabled to halt data transmission over 
flight-critical buses FC 5 through FC 8, payload buses 
PL 1 and PL 2 and launch data buses LDB 1 and LDB 2. 

The Backup Flight Control . (BFC ) sv/itches on panels F 2 
and F 4 also control the lOP Terminate Command B discrete. 

2.4.6 MM IPL Select Command Discretes 

These discretes specify which Mass Memory unit has 
been selected for IPL operation of the GPC. 

2.5 Mass Memory Discretes 

Each Mass Memory generates a ready signal and controls 
the state of the MM Ready discrete of each GPC. A ready sig- 
nal, when enabled, indicates to the GPC that the MM is in 
the standby mode and is capable of accepting commands. If 
not enabled, it indicates that either the MM primary power 
is off or that the MM is performing an operation. In the 
latter case, it will stay in the not-ready state until the 
operation being performed is complete. 

Reset discrete signals, one from each GPC, can inter- 
rupt the operation of the Mass Memory unit. When interrupted 
by the reset signal, the MM will halt its operation at the 
end of the current data block, stop the tape in the next 
subfile, and write protect all tracks. When these opera- 
tions are completed, the ready signal is enabled to the 
GPCs. If the MM is already in the ready state, no action 
will occur as a result of the reset. 

2.6 Backup Flight Control System Engage Command Discrete 

When this discrete is true, it means that the BFC En- 
gage switch on panels F 2 or F 4 is on and that the flight 
control is to be transferred from the Primary to the Backup 
Control System. When the discrete is false, it indicates 
that the BFC Engage switch is in 'off position and that 
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flight control is handled by the Primary system. 

2,7 Discretes of GPC 5, the Backup System 

GPC 5 is used for the Backup Flight Control System 
(BFCS). The BFCS can be engaged by pressing one of the 
two BFC Engage switches. VJhen one of these sv/itches is 
pushed, the BFCS Control Unit sends the I/O Terminate 
Command B to all of the computers. However, the polarity 
of this signal is reversed for GPC 5, v/ith the result 
that GPCs 1-4 have their flight-critical outputs disabled, 
and GPC 5 has its .outputs enabled, when a BFC switch is 
pushed. BFC Engage indicators, located in the BFC switches, 
are controlled by MDM FF5. 

The discrete signals for GPC 5 are listed in Table 2. 
(Since GPC 5 is not used in conjunction with the other four 
computers, there are no Fail Votes or synchronization sig- 
nals to or from GPC 5). In addition to the Fail Votes and 
synchronization signals, several other discrete control sig- 
nals are not used in GPC 5. No I/O Terminate switch exists 
for GPC 5, so the I/O Terminate Command A discrete input is 
not used. Since the BFCS does not use the Mass Memories, 
there are no Mass Memory Ready, Reset, or IPL Select signals 
connected to GPC 5; there is no IPL Activate switch/indicator 
and, therefore, the corresponding discrete signals are not 
used. The functions of the remaining discrete signals are 
as previously described. 
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3. PRIMARY AND SECONDARY EFFECTS OF FAULTS ON DISCRETES 


In this Chapter the primary and secondary effects of 
faults on the lOP discretes are discussed. First the Flight 
Computer Operating System (FCOS) modules that use these dis-' 
cretes and the manner of their usage are identified. This 
enables one to trace the propagation of errors from hard- 
ware to software. Secondly, each of these FCOS modules is 
analyzed to determine the effects of misinterpretation of 
the logic levels on the discretes due to single bit errors. 
This information will be i^seful in recovering GPCs that are 
lost due to discrete failures either in the OFT or post-mis- 
sion phase. It is also useful for modifying software modules 
so that the impact of discrete failures on system performance 
is minimized. Thirdly,’the impact of each discrete failure 
on the total system is described. This will give an assess- 
ment of the relative criticality of each discrete. Finally, 
the minimum] time before the detection of a discrete failure 
is estimated and suggestions are made to further reduce this 
time . 


The FCOS is a set of code blocks which manages the DPS 
computer hardware complex and allocates its resources to all 
OFP functions. It is responsible for the control services 
and allocation of computer resources, as well as the super- 
vision of all computing processes in the OFP, It also pro- 
vides a number of service functions, such as input/output, 
interrupt supervision and time/event services. The FCOS is 
a tool used by the application programmer and, when taken by 
itself, does not provide a mission software design. The FCOS 
does not partition or specify how software functions are di- 
vided between computers or within a computer. The FCOS does, 
however, provide the structure for controlling individual soft- 
ware functions to meet individual mission requirements [6] . 

Thus the FCOS serves as the interface between the hardware 
and the application programmer and represents the first stage 
in Control transition from hardware to software. Some of the 
FCOS modules interpret and act on the logic signals they read 
on the discretes. The flow-charts of these modules are shown 
in Figures 3-1 to 3-22. (They are extracted from Reference 
[5]). 


The modules that issue commands which cause logic level 
transitions on the discrete lines are analyzed to determine 
the effects of single-bit discrete errors. The flow-charts of 
these modules are shov/n in Figures 3-23 to 3-31. They indicate 
the correct commands to be issued (shown enclosed by double lines) 
as v/ell as the incorrect commands that may be issued due to a 
single discrete failure (shown enclosed by a single line). Thus 
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Figure 3-1. Timer Queue Element Expiration (FPMIHPC2) 
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Figure 3-2 
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Figure 3-4. BCE No/Go Procedure (FIOBCERR) 
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MSC Timeout Procedure (FIOMSCTO) 
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Figure 3-6. Count Data Path Error Procedure (FIOCTDpE) 
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Figure 3-9. Hass Memory Halt Processor (FIOHLTMH) 











Figure 3-10. MSC Set Fail Discretes Program (FIOMSFDl 




Figure 3-11. 


Read Blocks from Mass Memory Routine (FCMINMMR) 
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Figure 3-12. One Time Initialization Routine (FCMLINIT) 
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Figure 3-13. 


Power Transient Initialization Flowchart 
(FCMPINIT) 
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Figure 3-14. Initial SSIP Synchronization (FCMASYNC) 
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SVC Synchronization (FCMMSSYNC) 
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Figure 3-19. Fault Detection Identification (FCMFDI) 
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Figure 3-21. GPC Startup (AIC_GPC_STARTUP) 
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Figure 3-20* 

Normal SSIP Synclironization (FCMCSYNC) 
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Figure 3-29. 

Timer Synchronization (FCMTSYNC) 

















































In the flow-chart of the Timer Queue Element Expiration 
(FPMIHPC2) module, at the beginning Instead of issuing the 
NL/RN synchronization command, the module may issue IOC, 

TIMER or SVC synchronization commands. Table 4 summarizes 
the effects of single discrete errors on the FCOS modules 
by listing each module that uses/issues discretes along 
with the manner of invocation of the module and the dis- 
cretes (identified by their labels and pin numbers) that 
the module uses/issues. It also lists the possible mis- 
interpretation of discretes due to single bit discrete 
errors . 

In the followings each discrete is considered individu- 
ally to analyze its precise role in the DPS and how its 
failure can affect the system performance. The discussion 
will be qualitative and establish the relative criticality 
of each discrete. The discrete is analyzed by listing the 
FCOS modules it is used in, describing qualitatively the 
manner in which the discrete- is used in software logic, and 
depicting consequences that may ensue because of the discrete 
failure. In addition, an estimate is given of the time that 
may elapse before the failure is detected. 

3.1 Identification Discrete Failures 

These discretes are used by the following software 
modules directly or indirectly: 


Modul e 

Page No 

. [5] 


Usage 

FIOMMRLV 

3.2-61, 

Part 

1 

Indirect 

FCMLINIT 

3.3-11, 

Part 

1 

Direct 

FCMDSSTR 

3.3074, 

Part 

1 

Indirect 

FCMRELST 

3.3-75, 

Part 

1 

Indirect 

FCMENSTR 

3.3-77, 

Part 

1 

Indirect 

FCMSATCN 

3.3-81, 

Part 

1 

Indirect 

FCMSFAIL 

3.3-89, 

Part 

1 

Indirect 

ARC GPC RECONFIG 

3.2-19, 

Part 

2 

Indirect 


The hardware discretes are read directly by the One 
Time Initialization Routine, FCMLINIT, and the identifica- 
tion number of the GPC is stored in COMPOOL and CVT. There- 
after, the identification number is fetched whenever needed 
from these two tables. This number is used in software 
mostly to select the prime GPC among the Redundant Set. At 
hardware level, the identification number is used to assign 
proper control of data buses to the GPC. For example, the 
five ICC buses, each dedicated to one GPC, are physically 
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SEQ 

OF 







SINGLE BIT 
ERRORS 

PAGE MODULE 

INVOCATION USE 

DISCRETES 

LABEL PIM NUM. LOG 

INPUT 

DISCRETES 

LABEL PIN NUM LOG 

OUTPUT 

Wl^-L CAUSE 

REF. NO. 5 

OR 

IS- 

SUE 

USED 

VAL 

FROM 

ISSUED 

VAL 

TO 

DISCRETES 
TO BE INTER^ 
PRETEO AS 










D02D 

d3“A3,AR 

1 



SPARE 


1 






NULL SYNC 

D024 

d3-3'i,35 

1 

3 

lOPS 

IPR SYNC 









0028 

■J3-46,*»7 

1 



SSIP SYNC 









D020 

03-^3,44 

0 



TIMER SYNX 


2 






SSIP SYNC 

D024 

03-34,35 

0 

5 

lOPS 

SVC SYNC 









D02B 

03-46,47 

1 



HLT/OFF/FL 










OR 





PSW SVIAP FROM 








DO20 

03-43,44 

1 



SSIP SYNC 

1-5,1-49 FPMIHPC2 HARDWARE VIA 

2 

NONE 

N/A 

N/A 

N/A 

N/A 

TIMER SYNC 

0024 

03-34,33 

0 

3 

lOPS 

NULL/RUN 

PROG, CNTR. 2 








D023 

03-46, 47 

I 



SPARE 

INTERRUPT 








D02(> 

03-43,44 

1 



IPR SYNC 








IOC SYNC 

0024 

03-34,35 

1 

3 

TOPS 

SPARE 


3 







D028 

03-46,47 

0 



NULL/RUN ^ 










OR 













DO20 

03-43,44 

0 



IOC SYNC 


3 







D024 

03-34,35 

1 

3 

lOPS 

HLT/OFF/FL 









D023 

03-46,47 

0 



SVC SYNC 


Table 4- List of discretes used/issued by the FCOS modules 


-'EQ , SINGLE BIT 


PAGE MODULE 

OF 

TNVOflATION USE 

DISCRETES 

LABEL PIN NUH. LOG 

INPUT 

DISCRETES 

LABEL PIN NUM LOG 

OUTPUT 

ERRORS 
WILL CAUSE 

REF. MO. 5 

OR 

USED 

VAL 

FROM 

ISSUED 

VAL 

TO 

DISCRETES 

IS- 

SUE 







TO BE INTER- 
PRETED. AS 












0020 

d3-43,h4 

1 



SPARE 




1 






NULL SYNC 

D024 

U3-54, 35 

1 ■ 

3 

lOps 

IPR SYNC 



SOFTWARE GE- 








. D028 


1 



SSIP SYNC 

1-5.2-12A 

FIOCMPLT 

NERATED HARD- 
WARE I OP IRPT 


NONE 

N/A 

N/A 

N/A 

N/A 


0020"“ 

03-43,44 

1 



IPR SYNC 




2 






IOC SYNC 

D024 

03-34,35 

1 

5 

lOPS 

SPARE 











DO 28 

03-46,47 

0 



NULL/RUN 



CALL FROM 








0020 

03-43,44 

1 



IPR SYNC 

1-3.2-34 

FIOERRLC 

FIOCMPLT OR 

1 

NONE 

N/A. 

N/A 

N/A 

V N/A 

IOC SYNC 

0024 

03-34,35 

1 

3 

ipps 

SPARE 



FIDMMMGR 








0028 

03-46,47 

p 



HULL/ RUN 



EXECUTED FROM 








. DO20 

03-43,44 

0 



IOC SYNC 

1-3.2-37 

FIOBCERR 

FIOERRLC 

1 

NONE 

N/A 

N/A 

N/A 

N/A 

I PR SYNC 

D024 

03-34,35 

1 

3 

lOPS 

HLT/OFF/FL 











D02S 

03-46,47 

D 



SVC SYNC 



•EXEGUTED FROM 








D020 

03-43,44 

0 



IOC SYNC 

1-3,2-39 

FIOMSCTO 

FIOERRLC 

1 

NONE 

N/A 

N/A 

M/A 

N/A 

I PR SYNC 

D024 

03-34,35 

1 

3 

iops 

HLT/OFF/FL 











D028 

03-46,47 

Q 



SVC SYNC 



EXECUTED FROM 

1 

STANDBY 

0101 

J5-3v4 

1 

PANEL 








1-3.2-43 

FIOCTOPE 

FlbSCERR OR 
FIOMSCTO 

2 

terminate 

DlOO 

05-1,2 

1 

PANEL 

NONE 

N/A 

N/A 

N/A 


M/A 

N/A 




3 

BPCS ENGAGE 

Dill 

J5-23,24 

1 

PANEL. 









Table 4 (continued). . List of discretes used/issued by the FCOS modules 
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PRETED AS 





1 

MMl 

READY 

DI06 

05-12,13 

o 

MMl 









EXECUTED FROM 

1 

MM2 

READY 

DI07 

05-15,16 

•» 

MM2 . 







1-3.2-52 

hoMMSTR 

FTQMMPII 







NONE 

N/A 

N/A 

N/A 

N/A 

N/A 




2 

MMl 

IPU SEL 

DI04 

J5-B,9 


PANEL 









2 

MM2 

IPL SEL 

DI05 

05-10,11 

? 

PANEL 










1 

MMl 

READY 

D106 

05-12,13 

? 

MMl 









EXECUTED FROM 

1 

MM2 

READY 

DID7 

05-15^16 

•3 

MM2 







1-3.2-Stf 

FIOHMTMR 

fiqmmmgr 

2 

MMl 

IPL SEL 

DI04 

05-8,0 

? 

PANEL 

NONE 

N/A 

N/A 

N/A 

N/A 

N/A 




2 

MM2 

IPL SEL 

DJ05 

05-10,11 

7 

PANEL 









CALL FROM 














1-3.2-59 

FIOHLTMH 

FPMSVC 

1 


NOME 

N/A 

N/A 

N/A 

N/A 

MMi RESET 

D012 

iJ3-a.,16 

0 

MMl 

CONTINUE 




1 







MM2 RESET 

D013 

03-17,27 

? 

MM2 

CONTINUE 



CALL FROM 

1 







N+1 FAIL 

DR007 


? 

lOP N+1 

NOT FAILED 

1-3*2-80 

FIDMSFp 

FCM5VC OR 

1 


NONE 

N/A 

N/A 

N/A 

N/A 

N-i-2 FAIL 

DROOS 

JS-W,45 


TOP N+2 

NOT FAILED 



FCMFDl 

1 







N+3 FAIL 

DROQ9 

05-^0,41 

0 

lOP N■^3 

NOT FAILED 




1 







GPC FAIL 

□ROOD 

dS-4B,SB 

? 

PANEL 

NOT FAILED 




EXECUTED 

FROM 

1 

MMl 

READY 

0106 

05-12,13 


MMl 







1-3.3-10 

FCMINMMR 

FCMINSSL 


1 

MM2 

READY 

0107 

05-15,16 

O 

MM2 

NONE 

N/A 

N/A 

N/A 

N/A 

N/A 



EXECUTED 

FROM 

I 

GPC 

ID BITO 

DI32 

03-74,75 

? 

lOP N 







1-3.3-11 

FCMLINIT 

FCMINSSL 


1 

GPC 

ID BITl 

DI33 

03-116,123 

•a 

lOP N 

NONE 

N/A 

N/A 

N/A 

N/A 

N/A 





1 

GPC 

ID BIT2 

DI34 

03-107,122 

7 

lOP N 
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cn 

o 




1-3.3-23 


1-3.3-25 


POWER ON WITH 

FCMPINIT MODE SWITCH IN 1 STANDBY DIOl trS-3,4 1 PANEL NONE N7A N/A N/A N/A N/A 

RUN OR STDBY 




1 

GPC 

N+1 

SBl 

DI20 

J3-eo,91 ? 



1 

GPC 

N+2 

5B1 

DT21 

J3-92^104 ? 



1 

GPC 

N+3 

SBl 

□ 122 

J3-103>114? 



1 

GPC 

N+1 

SB2 

DI24 

J3-U3,121? 

FCMASYNC 

FPMSVC CALL 

I 

GPC 

N+2 

5Q2 

DI25 

J3-L12,12B? 



I 

GPC 

N+3 

SB2 

DI26 

J3-101,lll? 



1 

GPC 

N+1 

5B3 

DI28 

j3-ng^ia6? 



1 

GPC 

N+2 

SB3 

DI29 

J5-99,109 ? 



1 

GPC 

N+3 

5B3 

DI30 

J3-118, 125? 



1 

GPC 

N+1 

SBl 

D120 

J3-80,91 ? 



1 

GPC 

N+2 

SB! 

Dial 

J3-92,104 ? 



1 

GPC 

N+3 

SBl 

0122 

J3-103,114? 



1 

GPC 

N+1 

SB2 

DI24 

J3-113/121? 



1 

GPC 

N+2 

SB2 

D125 

J3-112^128? 



1 

GPC 

N+3 

5B2 

DI26 

d3-lDl^Ul? 

FCMCSYNC 

FPMIHPC2 CALL 

1 

GPC 

N+1 

SB3 

DI28 

J5-119,126? 



1 

GPC 

N+2 

SB3 

D129 

J3-99.109 ? 



1 

2 

2 

2 

GPC 

N+3 

SB3 

D130 

J3-lie,125? 


TOP N+1 
lOP N'*-2 
TOP N+3 
top N+1 

TOP N+2 none N/A N/A N/A N/A N/A 

TOP N'i'j 

top N+1 

TOP N+2 

!0P N’^3 

TOP N+l 
I OP N-S-2 
I OP N’^S 
lOP N+1 
TOP N+2 
I OP N+3 
lOP N+1 
I OP N+2 
lOP N+3 


GPC 

N 

SBl 

DO2 0 

-J3“43,44 

1 

3 

TOPS 

SPARE 

GPC 

N 

SB2 

D024 

U3-34,35 

1 

3 

TOPS 

TPR SYNC 

GPC 

N 

SD3 

D028 

J3-4G,47 

1 

3 

TOPS 

5SIP SYNC 
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OF 







ERRORS 

PAGE MODULE 

INVOCATION USE 

DISCRETES 

LABEL PIN NUM. LOG 

INPUT 

DISCRETES 

LABEL PIN NUK LOG 

OUTPUT 

WILL CAUSE 

REF. MO. 5 

OR 

IS- 

USED 

VAL 

FROM 

ISSUED 

VAL 

TO 

DISCRETES 
TO BE INTER- 


SUE 







PRETED AS 




1 

GPC 

N+1 

SBl 

DI20 

■ 3-*80y91 ? 

lOP 

N+1 



1 

GPC 

N-F2 

SBl 

DI21 

J3**92,104 ? 

I OP 

N+2 



I 

GPC 


SBl 

0122 

J3-103, 114? 

lOP 

N+3 



1 

GPC 

N+1 

SB2 

DI24 

d5“lX3,121? 

lOP 

N+1 



1 

GPC 

N+2 

S62 

DI25 

03-112^118? 

I OP 

N+2 

CJl 

CALL FROM 

1 

GPC 

N+3 

SB2 

0126 

03-101^111? 

I OP 

N+3 


1-3.3-29 FCMISYNC FIOCMPLT OR 

1 

GPC 

N+1 

SB3 

0128 

05-119^126? 

I OP 

N+1 


FIOMMMGR 

1 

GPC 

N+2 

5B3 

0129 

03-99ilD9 ? 

I OP 

N+2 



1 

GPC 

N+3 

$05 

0130 

03-118^125? 

I OP 

N+3 


2 

GPC 

N 

SBl 

DO20 


1 

3 

TOPS 

SPARE 

2 

GPC 

N 

SB2 

D024 

J3-34j35 

1 

5 

I OPS 

IPR SYNC 

2 

GPC 

N 

SB3 

0028 


1 

3 

10PS 

SSIP SYNC 


as? 


Table 4 {continued)* List of discretes used/issued by the FCOS modules 






PAGE MODULE 

SEQ 

OF 

INVOCATION USE 

DISCRETES 

LABEL PIN NUM. LOG 

INPUT 

DISCRETES 

LABEL PIN NUM LOG 

OUTPUT 

SINGLE BIT 
ERRORS 
WILL CAUSE 

REF. NO, 35 

OR 

USED 

VAL 

FROM 

ISSJEO 

VAL 

TO 

DISCRETES 


IS- 

SUE 







TO BE INTER’ 
PRETED AS 


1-3,3-35 


FCMSSYNC 


1 

1 

1 



2 

GPC 

N+1 

SBl 

DI20 

03-80,91 ? 

lOP 

N+1 


2 

GPC 

N-f.2 

501 

DI21 

03-92,104 ? 

I OP 

M+2 

CALL FROM 

2 

GPC 

N+3 

SBl 

DI22 

05-103, 114? 

I OP 

N+3 

SEVERAL MODS. 

2 

GPC 

N+1 

SB2 

DI24 

03-113,121? 

TOP 

N+1 

LISTED IN 

2 

GPC 

N+2 

5B2 

DI25 

03-112,128? 

lOP 

N+2 

REF, 52, 3. 3-28 

2 

GPC 

N+3 

5B2 

D126 

03-101, 111? 

lOP 

N+3 

FCOS 

2 

GPC 

N+1 

SB3 

D12B 

03-119,126? 

I OP 

N+1 


2 

GPC 

N+2 

SB3 

D129 

03-99,109 ? 

I OP 

N+2 


2 

GPC 

N+3 

SB3 

DI30 

03-118,125? 

lOP 

N+3 


3 

3 

3 


SVC SYNC 


GPC N S81 
GPC N SB2 
GPC N SB3 


DD20 J3-lt3,44 0 NULL/RUN 

D024 J3-34,35 1 3 lOPS SSIP SYNC 

D028 J3-46,47 1 IPR SYNC 


D020 J3-43,44 1 3 IOP5 SPARE 

D024 03-34,35 1 3 lOPS IPR SYNC 

D028 05-46,47 1 3 lOPS SSIP SYNC 


Table 4 tcontlnued) 


List of discretes used/issued by the FCOS modules 




SEQ 











SINGLE BIT 



OF 











ERRORS 

PAGE 

MODULE 

INVOCATION USE 

DISCRETES 

LABEL PIN NUM. LOG 

INPUT 

DISCRETES LABEL 

PIN NUM 

LOG 

OUTPUT V/TLL CAUSE 

EF, m. 5 


OR 

USED 



VAL 

PROM 

ISSUED 



VAL 

TO DISCRETES 


IS- 











TO BE INTER- 



SUE 











PRETED AS 



1 

GPC N+1 

SBI 

0120 

j3-afl,9i ? 

lOP N+1 









1 

GPC N+2 

SBl 

DI21 

J3-92,10i* ? 

lOP N+2 









1 

GPC N+3 

SBI 

DI22 

J3-103^114? 

lOP N+3 









1 

GPC N+1 

SB2 

DI24 

J3-U3^121? 

lOP N+1 









1 

GPC N+2 

SB2 

DI2S 

03-112,128? 

lOP N+2 









1 

GPC N+3 

SB2 

DI26 

03-101,111? 

lOP N+3 







1-3,3-37 

FCMTSYNC 

FPMIHPC2 CALL 1 

GPC N+1 

SB3 

0128 

03-119,126? 

lOP N+1 









1 

GPC N+2 

5B3 

DT29 

J3-99,X09 7 

lOP N+2 









1 

GPC N+3 

5B3 

D130 

J3-1X8,125? 

lOP N+3 









2 






GPC 

N SBI 

DO20 


1 

3 lOPS SPARE 



2 






GPC 

N 5B2 

D024 

05-54,35 

1 

3 TOPS IPR SYNC 



2 






GPC 

N SB3 

D02B 

03-46,47 

1 

3 lOPS SSIP SYNC 

1-3.3-39 

FCMFDl 

FIOCMPLT CALL 1 

NONE 


N/A 

N/A N/A N/A 

GPC 

FAIL 

DROOO 

05-46,58 

1 

PANEL NOT FAILED 



o 

GPC N+1 

FLI 

DRI03 

J5-36,37 ? 

lOP N+1 

GPC 

N+i FLO 

DRO07 

05-44,45 


lOP N+1 

1-3.3-93 

FCMSVC 

FPMSVC CALL ? 

GPC N+2 

FLI 

DRIQ4 

J5-3S,47 7 

lOP N+2 

GPC 

N+2 FLO 

DR0D8 

05-42,43 


lOP N+2 



9 

GPC N+3 

FLI 

ORI05 

J5-33,54 ? 

lOP N+3 

GPC 

N+3 FLO 

DRO09 

05-40,41 

■p 

lOP N+3 









GPC 

N FLO 

DROOO 

05-46,58 

? 

lOP N 


Table 4 (continued)* List of discretes used/issued by the FCOS modules 






SEQ 










SINGLE BIT 




OF 










ERRORS 

PAGE 

MODULE 

INVOCATION 

USE 

DISCRETES 

LABEL 

PIN NUM. 

LOG 

INPUT 

DISCRETES 

LABEL 

PIN NUM LOG 

OUTPUT 

WILL CAUSE 

REF. m, 5 



OR 

USED 



VAL 

FROM 

ISSUED 


VAL 

TO 

DISCRETES 


— 


IS^* 






- 




TO BE INTER- 




SUE 










PRETED AS ' 

3 - 3,1715 

AIC_GPC_ 

GPC STARTUP 

1 

NONE 

N/A 

N/A 

N/A 

N/A 

GPC READY 

DO09 

J3-25,37 1 

PANEL 

NOT READY 





1 

GPC RUN 

DI02 

U5-5,6 

? 

PANEL 









1 

GPC STANDBY 

DIOl 

J5-3.4 

2 

PANEL 









1 

BFC5 ENGAGE 

Din 

J5-23,24 

? 

PANEL 






cn 

3-3,25 

ARA GPC 

SWITCH MONIT 1 

I/O TERM, A 

DH2 

J5-25,26 

0 

PANEL 








SWITCH 

1 

I/O TERM.B 

DI13 

JS-27,28 

? 

PANEL 

I/O 

TERM. A 

DI12 

J5-25/26 

? PANEL 










I/O 

TERM.B 

DI13 

J5-27,2B 

? PANEL 


Table 4 (continued). List of discretes uspd/issu&d by the FCOS nodules 



connected to all the 
cate with other GPCs 
ICC1 with the aid of 
CVT and COMPOOL. 


GPCs. When GPC1 desires to communi- 
through the ICC buses* it selects 
the identification number stored in 


The requirement that each GPC correctly records and 
maintains the identification number is crucial to space 
shuttle operation; if this requirement is not met, either 
because of discrete failure or faulty core locations, the 
ensuing consequences will be unpredictable. When two GPCs 
have the same identification number and attempt to trans- 
mit information on a common bus, signal interference results. 
If this bus is not flight-critical or an ICC bus unit, data 
bus I/O failures will be recorded and this may eventually 
lead to bus masking and its removal. However, if this bus 
happens to be either critical or an ICC bus, the GPCs in 
command of the bus will force themselves to synchronization 
failures. Thus the two GPCs will drop out from the redun- 
dant as v/ell as the common set. If they attempt to communi- 
cate their- synchronization failures and use the same data 
bus for doing so, signal interference once again results 
with the consequence that the crew may not be notified. At 
this point, the situation becomes unpredictable and may even 
lead to loss of spacecraft control. 


The CPDS requirements stipulate that the software shall 
support a display which monitors the operational status of 
each GPC in Redundant Set, simplex, failed or OFF/HALT mode [6]. 
Thus the crew may note from the display that the two GPCs 
are not functioning properly and may engage the Backup Flight 
Control Switch. 


The time that might elapse before detection of the iden- 
tification discrete failure is variable. Since the identi- 
fication discretes are read on the ground prior to the mission, 
any discrete failures at this time will be immediately notice- 
able. Once the discretes are read, the identification number 
is fetched only from the internal GPC tables and hence the 
identification failure may result due to core memory location 
faults. If this happens, the time of detection is unpredict- 
able and depends to a large extent on the crew action. 

A quantitative assessment of the identification failure 
will be given in the next chapter. 
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3,2 Synchronization Discrete Failures 

Synchronization discretes are used by the follovn'ng 
software modules directly or indirectly: 


Modul e 

Page d 

. [5] 


Usage 

FPMIHPC2 

3.2-49, 

Part 

1 

Direct 

FIOCMPLT 

3.2-12a 

, Part 

; 1 

Direct 

FIOERRLC 

3.2-34, 

Part 

1 

Direct 

FIOBCERR 

3.2-37, 

Part 

1 

Direct 

FIOMSCTO 

3.2-39, 

Part 

JL 

Di rect 

FCMASYNC 

3.3-23, 

Part 

1 

Direct 

FCMCSYNC 

3.3-25, 

Part 

1 

Direct 

FCMISYNC 

3.3-29, 

Part 

1 

Direct 

FCMSSYNC 

3.3-35., 

Part 

1 

Direct 

FCMTSYNC 

3.3-37, 

Part 

1 

Direct 

FCMBMAN 

3.3-63, 

Part 

1 

Indirect 

FIOSVC 

3.2-9, 

Part 1 


Indirect 

FIOSVCP 

3.2-12, 

Part 

i* 

Indirect 

FPMCANCL 

3.1-35, 

Part 

1 

Indirect 

FPMCLOSE 

3.1-27, 

Part 

1 

Indirect 

FPMIEPCT 

3.1-39, 

Part 

1 

Indirect 

FPMOPSCN 

3.1-38a 

, Part 

1 

Indi rect 

FPMRES 

3.1-19, 

Part 

1 

Indirect 

FPMRESET 

3.1-67, 

Part 

1 

Indirect 

FPMSCHED 

3.1-9, 

Part 1 


Indirect 

F PM SET 

3.1-68, 

Part 

1 

Indirect 

FPMSIGNL 

3.1-69, 

Part 

1 

Indirect 

FPMSTAT 

3.1-25, 

Part 

1 

Indirect 

FPMTERM 

3.1-31, 

Part 

1 

Indirect 

FPMTMHAL 

3.1-63, 

Part 

1 

Indirect 

FPMUPRIO 

3.1-23, 

Part 

1 

Indirect 

FPMWAIT 

3.1-17, 

Part 

1 

Indirect 

FCMPMOD 

3.3-53, 

Part 

1 

Indirect 

FCMBCEMD 

3.3-55, 

Part 

1 

Indirect 

FCMPOVLY 

3.3-49, 

Part 

1 

Indirect 

FJOHLTMM 

3.2-71, 

Part 

1* 

Indirect 

FPMUPMTU 

3.1-55, 

Part 

1 

Indirect 

FPMMTURM 
^Reference [7] 

3.1-73, 

Part 

1* 

Indirect 


The software modules listed under direct usage issue 
commands that directly change the status of the synchroni- 
zation discretes and use these discretes in their logic. 

The indirect-usuage modules invoke the direct-usage modules 
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in order to achieve software synchronization throughthe . 
synchronization discretes. As can be noted, these discretes 
are used extensively by the software to operate the GPCs in 
the Redundant and Common Sets in synchrony with each other 
and minimize the data skew which exists because of the redun- 
dant operation of the GPCs. 

A synchronization discrete failure will cause the remov- 
al of the GPC it is associated with from the Redundant and 
Common Sets, even though the GPC may be functioning properly. 
The outcome of this type of failure is the loss of a GPC, and 
the crew is immediately notified of the synchronization fail- 
ure through the Computer Annunciation Matrix, Since the 
synchronization discretes are used as often as 300 times/sec- 
ond by application programs, the failure of these discretes 
is immediately observed. Also, since the SSIP and Fast-Cycle 
Execution programs use synchronization at every 40 ms interval, 
the upper bound on the time of detection of synchronization 
discrete failures is approximately 20-30 ms. 
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3.3 Redundancy Management Discrete Failures 

The following modules can alter the state of redun- 
dancy management discretes: 


Modul e 


Page No. [5] 


Usage 


FCMSVC 

FCMFDI 

FCMVOTE 

FPMSVC 

FIOCMPLT 


3.3- 93, Part 1 

3.3- 39, Part 1 
3.2-83, Part 1* 

3.1- 21, Part 1 

3.2- 129, Part 1 


Direct 
Direct 
Direct 
Indi rect 
Indirect 


*Reference [7] 


The direct usage modules can change the status of 
fail discretes that drive the Computer Annunciation Matrix. 
The indirect usage modules invoke the direct-usage modules. 
When a failure occurs on one of these discretes, the light 
driven by the faulty discrete may be lit. However, this 
may not have any undesirable consequences since the crew, 
by observing the other three lights in the same row, can 
deduce whether the light is energized due to a discrete 
failure or to a GPC failure. The situation with the 6PC5 
fail discrete is different; 6PC5 performs self testing to 
see whether it is functioning properly and is not involved 
in cooperative testing. Thus, when the light connected 
to the GPC5 fail discrete is energized, the crew may not 
know whether this is due to a discrete failure or due to 
the Backup Computer System failure. In this situation, the 
consequences are dependent on the crev; action- In the 
worst case, the crew may assume the loss of Backup System 
even though this system may be functional. Any failure on 
the redundancy management discretes is immediately notice- 
abl e . 
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3.4 Control and Indicator Discrete Failures 

The GPC Standby/Run Command discretes are monitored 
by the ARA_6PC_ SWITCH module (Page 3.3-25, Part 3 [5]) 
once per every second v/hereas the GPC Ready indicator is 
controlled by the AIC_GPC_STARTUP module (Page 3.1-15, Part 
3 [5]). The Halt indicator has hardware control on the GPC 
operation and thus is not used in software logic. When a 
Standby or Halt discrete is set erroneously due to transient 
or permanent faults, the GPC stops participating actively in 
computation and control of the space shuttle, thus resulting 
in a GPC loss. Within seconds, the crew will be notified of 
the loss of the GPC and its status, and thereafter the action 
of the crew decides the consequences. The Run Command is 
accepted by the GPC only when it has been initialized and is 
in a Standby state. Thus, a Run Command discrete, when it 
is set prematurely, may cause the GPC to start computation 
before it is expected to do so. However, this should not 
have any adverse consequences. 

When the GPC IPL discrete is prematurely set false when 
IPL is being performed, the crew may be under the impression 
that the GPC is IPL'ed and ready to go. However, since the 
IPL operation takes of the order of milliseconds, this type 
of discrete failure does not cause any severe problems. The 
IPL Activate discrete, if affected by transient failures, 
also does not cause adverse problems. However, permanent 
faults on these discretes mean the loss of the GPC and re- 
duced computational power. 

The I/O Active indicator discrete falls into the same 
category as the preceding two, in that its transient failure 
does not cause adverse consequences. If the discrete is 
erroneously set true indicating that the lOP is ready to ac- 
cept crev/ commands where, in actuality, this may not be so, 
the cre’W may initiate commands which may be lost. Here again, 
the resulting consequences depend on the crew interpretation 
of the situation. 

Transient errors on the I/O Terminate Command A and B 
discretes can cause data path errors logged againt the 
flight-critical buses. When this happens, the software mod- 
ule FIOCTDPE is invoked to see if there is any change in the 
status of the Standby/Halt or BFCS Engage switches. If 
these switches do not indicate any changes and more than P 
(nominally two) FC 1-4 or FC 5-8 data paths are masked, the 
GPC forces itself to a synchronization failure and removes 
itself from the Redundant Set. Whenever a data path is 
masked due to an error, the data path error is annunciated 


59 



to the user. Thus the net effect of I/O Terminate dis- 
crete failures can be the loss of a GPC. The crev/ may 
not be able to deduce whether the GPC loss is due to I/O 
Terminate discrete failures or to the GPC failure. 

The MM IPL Select Command discrete transient failures 
can cause a wrong MM to be selected for IPL. These fail- 
ures are not critical, and in the worst case the GPC will 
not be IPL'ed. Transient failures on the Mass Memory dis- 
cretes have similar effects on the IPL of the GPC. Also, 
the uplink/downlink capabilities to/from the MHUs will be 
temporarily affected by the transient failures. 

The BFCS Engage Command discrete, when set true erro- 
neouly, can cause invocation of the software module FCMBMASK 
and this may lead to data path masking. Thus a failure on 
this discrete can cause the loss of GPC. 

For the Backup Control System, any single transient 
failure on the BFCS discretes does not cause the BFCS to be 
engaged. The three BFCS Engage Commands and the lOP Termi- 
nate Command B Inverse discrete are majority voted to 
decide when the Backup System is to be engaged. The BFCS 
Fail discrete failure can cause the crew to think that the 
BFCS control unit is not operational whereas, in actuality, 
this may not be so. As mentioned before, the GPC Fail indi- 
cator discrete failure may misinform the crew as to the 
operational status of the BFCS. 
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3.5 Discrete Failure Analysis 

In the preceding sections the effects of a fault on 
each discrete is discussed individually; in the present 
section this discussion is extended to transient and 
permanent discrete failures and their effects on the 
entire system. The discussion is summarized in Table 5, 
which lists each discrete failure, transient and perma- 
nent, together with information regarding recoverabil ity 
from this failure and consequences in the worst case. 

The redundancy management and synchronization discretes 
are used when the GPC is included in the Redundant Set and 
hence permanent failures of any of these discretes imply 
that the GPC cannot be used in a redundant computation. 

On the other hand, the GPC can be used to. compute by itself 
and thus these failures are not critical for self-operation. 
Transient failures on the synchronization discretes result 
in the loss of the GPC from the Common and Redundant Sets 
as mentioned before in the previous sections; however the 
GPC can be recovered by re-initialization. Transient failures 
on the redundancy management discretes do not have any effects 
on the DPS; however, if these failures are misinterpreted by 
the crew, this may cause the loss of the GPC once again. The 
GPC 5 Fail discrete, if it malfunctions due to a transient 
error, can cause an alarm, and here again the resulting conse- 
quences are decided by the crew action. 

The control and indicator discretes are necessary for 
proper operation of the GPC and permanent failure of any of 
these discretes imply permanent loss of the GPC. Transient 
errors on these discretes may or may not have an effect on the 
system performance depending on the crew interpretation of 
the situation. Thus if the TOP Indicator discrete fails for 
a short time, the crew may attempt to use the GPC after awhile 
or disable the GPC from further computation. If the IPL dis- 
cretes are not functioning properly because of transient errors 
the crew may decide to try IPL repeatedly or once again remove 
the GPC from computation. 

The BFCS is designed so that transient and single errors 
on the BFCS discretes do not have any effect. The BFCS Engage 
Command and I/O Terminate Command discretes are niajority-voted 
and tested for stability before any action is attempted. Thus 
only multiple simultaneous faults which persist for over two 
consecutive minor cycles can cause engagement of the BFCS. If 
other GPCs are not properly disabled from their data buses, 
totally unpredictable consequences may ensue. 
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01 sere te 
Type 

Failure 

Type 

Effects and 
Recoverability 

Worst-Case 

Consequence 

Time of 
Detection 

Identification 

Transient 

Permanent 

If the failure occurs in the 
preinitialization phase on 
the ground, the failure can 
be detected by monitoring 
the displays and recovered, 
If the failure occurs 
after one-time Initial Izar 
tioni no effect on the sys- 
tem* 

If the Identification discrete 
failure is not noticed on the 
ground (which is unlikely) the 
entire OPS will be non-functional. 

Immediate, by 
observing the 
displayed 
status of the 
GPCs* 

Redundancy 

Management 

Transient 

Single transient errors do not 
have any effects. Multiple 

simultaneous transient errors Loss of a GPC depending on the 

can cause disablement of crew action. 

correctly operating GPCs by 

the crew. A transient error on 

the GPC 5 Fail discrete Indicates 

the BFCS is not ready to take over* 

Immediate 


Permanent 

Single permanent errors do not 
have any effects. Multiple 
errors lead to the loss of the 
GPC, The GPC can be operated 
in a self mode. 

Loss of a GPC from the Redundant 
Set. 

Immediate 


Table 5, Discrete failure analysis. 


OiscrctE 

Type 


Failure 

Type 


Effects and 
Recoverability 


Worst-Case 

Consequence 


Tifne of 
Detection 


cn 

OJ 



Transient 

Transient errors cause re- 
removal of the GPC from the 
Redundant and Common Sets, 
The GPC can be recovered fay 
forming a new Redundant Set. 

Loss of a GPC from the Ke 
dundant and Common Sets. 

Synchronization 

Discretes 

Permanent 

Permanent errors imply that 
the GPC cannot be operated 
In a redundant mode; but 
it can be operated in a 
self mode with self-testing 
to impi"Dve reliability. 

Loss of a GPC 
operative and 
computation. 

from co- 
redundant 


Synchronization 
discretes are used 
at every 20 ms in- 
tervals in 5S1P and 
Fast Cycle Proces- 
sor Phases and in 
GW&C as many times 
as 300 per second. 
The time of de- 
tection 1s im- 
mediate. 


td 


Table 5 (continued). Discrete failure analysis 


Discrete 

Type 


Failure 

Type 


. E-^fects and 
Recoverabi 1 1 ty 


Worst-Case 

Consequence 


Time of 
Detection 




Transient 


GPC Halt/Standby/ 
Run Command 
Discretes 


Permanent 


Transient errors on the GPC 
Kalt/Standby Command dis- 
cretes force an operating 
GPC into a Halt or Standby 
mode 4 Errors on Run Com- 
nand discrete have an ef- 
fect only in Standby mode* 
The GPC can be recovered 
by performing an IPL and 
placing it in proper mode* 

Permanent errors have the 
same effect as transient 
errors. The GPC cannot be 
recovered as in the 
transient error case* 


Forced termination of a cor- 
rectly operating GPC* 


Forced termination of a 
correctly operating 
GPC and the permanent loss 
of a GPC. 


These Command dis- 
cretes are moni- 
tored once a sec- 
ond and the status 
of the GPCs is 
displayed on moni- 
tors, Time of de- 
tection is imme- 
diate. 


Table 5 (continued). Discrete failure analysis 


cn 

cn 


ss 

II 

Is 

s® 

®c 





Discrete 

Type 

Failure 

Type 

Effects and 
Recoverability 

Worst-Case 

Consequence 

Time of 
Detection 

GPC Ready 
Indicator 

Transient 

If the Ready Indicator comes 
on prematurely while perform- 
ing the IPL and the crew ini- 
tiates commands, the GPC may 
not respond. To recover' from 
this error, tne crew should 
reinitiate their commands 
instead of disabling the GPC, 

Loss of a GPC because of the 
crew action. (This is unlikely 
because IPL takes of order 
.5 ~ .75 seconds . } 

Immediate 



Permanent 

Effects are the same as in the 
transient case. The GPC can- 
not be brought to a Halt state 
and reinitialized. 

Permanent loss of a GPC -when 
it is brought to the Halt 
state. 

Immediate 

IPL 

Discretes 

Transient 

Transient errors on IPL dis- 
cretes cause improper IPL. To 
recover from these errors IPL 
has to be performed again. 

Loss of a GPC depending on 
the crew action. 

Immediate 



Permanent 

Effects are the same as in the 
transient case. Permanent er- 
rors on IPL discretes imply 
that the GPC cannot be re-IPLed 
properly. 

Permanent loss of a GPC if 
it is brought to the Halt 
state . 

Immediate 


Table 5 (continued). Discrete failure analysis 




Discrete 

Failure 

Effects and 

Worst-Case 

Time of 

Type 

Type 

Recoverabil i ty 

Consequence 

Detection 



A transient or permanent fail- 
ure can cause an erroneous indi- 
cation that does not reflect the 

Disablement of a GPC de- 
pending on the crew action. 

Immediate 

I/O Active 

Transient 

true status of the lOP. Tran- 


Indicator 

Permanent 

sient errors can be ignored 
but a permanent failure means 
that the GPC cannot be used 

Loss of a GPC, 

Immediate 



again. 





Transient errors cause disable- 
ment of data buses from the 




Transi ent 

GPC and possibly its ultimate 

Loss of a GPC from the Re- 




removal from the Redundant Set* 
The GPC can be recovered by re- 

dundant Common Sets. 

Depends on data 

I/O Terminate 


initialization and formation 


bus activity* In 

Command 


of a new Redundant Set- 


all cases the de- 

di scretes 


Permanent failures imply the 

Permanent loss of a GPC from 

tection will be 
immediate and with- 


Permanent 

loss of the GPC from further 

further computation and 

in seconds. 



computation. 

control , 



Table 5 {continued}- Discrete failure analysis 


Discrete 

Type 


Failure 

Type 


Effects and 
Recoverability 


Worst-Case 

Consequence 


Time of 
Detection 
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Mass Memory 
Discretes 


Transient faults can cause IPL 
not to be performed properly in 
Transient the IPl phase. Transactions in- 
volving MMUs may not be com- 
pleted properly. The MMUs can 
be recovered by re-tries. 

Same as in the transient case. 
Permanent failures imply 
Permanent the loss of HMU(s) and soft- 
ware modules and consequently 
the entire DPS. 


Loss of a GPC depending 
on the crew action. 


Permanent loss of MMU(s) 
and possibly the entire 
DPS, 


Immediate in the 
IPL phase. At 
other times, 
dependent on 
the frequency 
of MMU usage. 




Transient failures can cause 
disablement of data buses from 

Loss of a 

GPC 

from the 



Transient 

the GPC and force the GPC to a 

Redundant 

and 

Common 




synchronization failure. The 

Sets , 



Dependent on 

BFCS Engage 


GPC can be recovered by re- 




data bus activity. 

Discrete 


initial ization. 




In all cases 

{GPC 1 - 4) 


Effects are the same as in the 




time of detec- 
tion vnl 1 be 



transient case, The GPC can- 

Permanent 

loss 

of a GPC. 

within seconds. 


Permanent 

not be recovered from this 
failure and hence it is not 
available for computation. 
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Discrete 

Type 


Failure 

Type 


Effects and 
Recoverabil i ty 


Worst-Case 

Consequence 


Time of 
Detection 


BFCS Engage 
and I/O Terminate 
Command Discretes 

Transi ent 
Permanent 

Only multiple simultaneous 
transients that last for 
two minor cycles on these 
discretes can have an 
effect, 

A single permanent failure 
does not have any effect. 
Multiple failures can cause 
unreliable and unpredictable 
OPS performance. 

Engagement (or dis- 
engagement) of 
BFCS. ■ 

Immediate 



Transient failures can be 


Immediate 


Transient 

ignored since they do not 





have any effect on the DPS, 



BFCS Fail 







A permanent failure means 

Loss of BFCS# 

Immedi ate 


Permanent 

that the BFCS is not opera- 





tional . 
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4. PROBABILISTIC ANALYSIS OF DISCRETE FAILURES 


In this chapter, a probabilistic analysis of dis- 
crete failures is given. The anlysis is necessarily limited 
because of the lack of detailed information regarding the 
circuit and component reliabilities- An exponential failure 
law is assumed in the analysis throughout. 

4.1 Identification Failures 

Identification failures vnll be due either to the iden- 
tification discrete failures or to the core memory location 
failures. Since the former type of failure is detectable 
on the ground and thus correctable, only core memory fail- 
ures will be considered in the following. (Although the 
scope of the present Contract covers only the effects of 
discrete failures, the criticality of the situation necessi- 
tates the consideration of core memory failures). Each core 

element follows the reliability law R = e where 1/X is 

the mean life of the element. The identification numbers of 
the four primary GPCs can be changed or misread due to the 
unreliable operation of core elements. For simplicity of 
analysis, it is assumed that once this happens, catastrophy 
ensues because of the resulting conflicts for data buses. 

(The software can possibly detect certain identification num- 
ber errors, such as the number being equal to 000 or greater 
than 100). Then the probability P of obtaining correct 

identification numbers can be given as 

-12X t 

Pc = ® (1) 

and the mean time to the catastrophic error as 


= .0833/^c (2) 

The probability of catastrophic error can be minimized 
by using a redundant or coding approach. In the redundant 
approach each identification number is stored in three memory 
locations and majority voting is performed to obtain the cor- 
rect identification number, assuming as before a failure rate 
of X^ for each core element. The probability that the correct 

identification number is generated is 

*In the following the term core element refers to the magnetic 
core and its associated read/write circuitry. 
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Pcor = Pq " 00Pc(l-Pc) 

<0 it) ^ (?) (I)p^(l-Pc)^ 


where is the probability that the core element is func- 
tioning properly. Since 

= e , 


it folloV7S 


-6X t -9X t 
R (t) = 3e • ^ - 2e 


The probability of catastrophic failure occurrence due to 
identification number error can now be determined as 


p; = = 

-30A t 

+ 216e ^ - 


-24A„t "27A„t 

81e ^ - 216e 


-33X^t -36A.t 

96e *^+166 


(3) 


The following coding approach may also be used to 
reduce system unreliability. Assume that six bits are assigned 
(instead of three) for each identification number in the 
following manner: 


SPCl 

00 

00 

00 

GPC2 

01 

01 

01 

GPC3 

10 

10 

10 

GPC4 

11 

11 

11 


Each identification number is at least three units 
of distance from other identification numbers and hence 
this coding can correct one and detect two core element 
failures in each identification number location. The 
probability of identification numbers being correct can be 
derived as 


^cor 


{Pc 6p®(i-p^) + apjd-p^j^}-! 


= 81pJ® - 21613^® + 216p^° - 96p^2 + 16p^^ 


Assuming p to be exponential as before, the reliability of 
correct generation of identification numbers can be found as 

-16\^t 18X^t -20X.t 

P^(t) = 8Xe ^ - 216e ^ + 216e 

-22X^t -24X. t 

+ 96e ^ + 16e (4) 


The failure rate for the entire 64K x 36-bit- GPC memory 
is approximately 500 failures/million hours.* Assuming that 
when a core element fails, it is due to the read/write 
amplifier circuitry, X„ can be determined approximately as 

.75 failures/10 hours. When X^t is small. 



1-12X t 
c 

(1') 

P * 

c 

l-108{X^t)^ 

(3') 

p» . 

l-48{X^t)2 

(4') 


*Private communication from Mr. Paul Sollock of NASA-JSC. 
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It follows that the unreliabilities can be given as 


% = " 12X^t (5) 

Q' = 1-P‘ - 10a(X^t)2 (6) 

= 1-p;; - 48(A^t)2 (7) 

The improvements in system reliability using the redundant 
and coding approaches can be given as 

Fr = Q^/Q' - l/9(X^t)2 (8) 

F(, = Q^/q;; - l/4(A^t)^ (9) 


Figures 4.1 and 4.2 show P , P* and for X ^ 10" % 

C C C 0 

- 7 - 7 - 6 

2x10" , 5x10“ and 10“ failures/hour as t varies from 

.15 to 2.1 hours, whereas Figure 4.3 shows the improvements 
in system reliability using coding and redundant approaches. 
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4.2 Effects of Discrete Failures on 

System Reliability 

In this section, a quantitative analysis of the 
effects of discrete failures on the entire system relia- 
bility is attempted. The mission duration time, during 
which the Primary Control System is effective, is estab- 
1 ished . 

The following effective failure rates are assumed 
for the lOP discretes: 


Discretes 

Redundancy Management 
Synchronization 
I/O Active Indicator 
GPC Ready Indicator 
GPC IPL Indicator 
GPC Halt 
GPC Standby 
GPC Run 

MMi IPL Select 
I/O Terminate A 
I/O Terminate B 
MMi Reset 
MMi Ready 
BFCS Engage 


Effective Failure Rate 

■^RM * ^RM 
■^SYNC * ^SYNC 
■^lOA * ^lOA 
■^GPCR ■ ^GPCR 
^GPCI * ^GPCI 
’^GPCH * ^GPCH 
■^GPCS * ^GPCS 
'^GPCR ' ^GPCR 
■^MMil ’ ^MMil 
^lOTA ■ ^lOTA 
■^lOTB * ^lOTB 
^MMiS ■ ^MMiS 
^MMiR ' ^MMiR 
’^BFCE ‘ ^BFCE 


The value of ir for a given discrete can be chosen 1 or 0 
depending on whether a fault on this discrete causes the crew 
to remove the GPC associated with it. Thus if the IPL Indicator 
discrete fails but the crew chooses to ignore it can be set 

to 0. The failure rate for each GPC is “ 
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~ Discrete ^Discrete * ^Discrete 


v/here Discrete runs through all the discretes listed above. 

The probability of correct operation of the DPS 
can be given as 


^cor ~ p(correct operation jnon-standby) . 
p (non-standby) + 
p(correct operation jstandby) . 
p(standby) 










where p^ and Pg are the probabilities that the primary and 
backup systems are working properly. Assuming a failure 
rate of Xg for the Backup System* one has for the reliability 
of the entire computing system 


Rjt) ={6 e 


-axgpct 


}■ 




-ist 


-ZXpppt “^Xpppt -(ZXpnp 

= 6e - 6e - 6e ® 


+ 6e 


+ e 


and the mean time to the first failure of the DPS as 
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3 1 

C (2Xgpj,+ + 

Letting p = ^GPc^^B’ ^c 

Tj. ^ 1 ( i6P^+24p^+2Qp+3 

^GPC ( 16p^+12p+2 



In determing ^QpQ> the value of tt for a given dis- 
crete can be chosen 1 or 0, depending on v/hether a fault 
on this discrete causes the crew to remove the GPC associ- 
ated with it. Thus if the IPL Indicator discrete fails 
but the crew chooses to ignore it, ■n"gpf;;j can be set to 0. 


The unreliability of the entire DPS, Q (t) 

c 

in Figures 4-4 through 4-7. The values of Xgp^, 


is shown 
are select- 


ed to be 100, 200, 500 and 1000 failures/10® hours and p 
varies from 1 to 100. Figure 4-8 shows the variation, of 
successful mission time with respect to the ratio T /T„n,^ 

Zf GPC 

where T^pg = 1/Xgpj,. It is interesting to note that this 
ratio is nearly proportional to p. 
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Figure 4-8. Graph showing Tq/T^pc with respect 
to p “ ’ 










5. RECOMMENDATIONS 

Based on the investigation carried out under this 
contract, the following recommendations are made to 
improve the reliability of the DPS. 

1) Because of the critical nature of identification 
failures, it is strongly recommended that the 
software design incorporate coding and/or re- 
dundant approaches in accessing identification 
numbers from the core memory. These approaches 
not only prevent catastrophic failures occurring 
due to single core element failures but also de- 
tect when a correct identification number is 
generated. Such, detection can be used to in- 
form the GPCs to turn themselves off instead 

of creating interferences on data buses. 

2) The synchronization discretes are used at rates 

of 300/second and because of their vital importance 
in keeping the computer systems in synchrony, it 
is strongly suggested that hardv/are redundancy be 
incorporated in these discretes. Though software 
to support synchronization discrete redundancy is 
a possibility, this does not appear to be a practi- 
cal solution in view of the rates at which these 
discretes are used. It is recommended that each 
synchronization discrete be triplicated with major- 
ity voting and possibly a spare discrete. (There 
are many spare discretes that are not used in the 
lOP 40/32 discretes.) 

3) After a careful review of the other discretes and 
the manner they are incorporated into the system de- 
sign, it is concluded that no further significant 
improvements can be made to the existing design. 

The present design requirements and implementations 
support direct/indirect monitoring of the status of 
the discretes that makes it possible to detect mal- 
functions. The crew, by observing the information 
displayed, can deduce the operational status of 
the discretes such as the Halt/Standby Run dis- 
cretes, IPL discretes, etc. 
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The follovn'ng tests are recommended to test and im- 
prove the reliability of the space shuttle: 

1) Test the reliability of the synchronization 
discretes and evaluate their failure rates. 
Simulate the situation, by means of software, 
where one or more synchronization discretes 
fail in each GPC and determine the consequences. 
Check whether the crew can successfully switch 
the control to the Backup System within safe 
time limits. 

I 

2) Simulate core memory failures to generate wrong 
identification numbers and determine the conse- 
quences. Test whether the crew can detect the 
malfunction of the DPS and develop a list of 
symptoms that the crew can observe to detect 
identification number failures. 

3) Conduct experiments on the discrete circuits to 
determine the failure rates of the lOP discretes 
so that the failure rate of the entire DPS due 
to discrete failures can be determined. 

4) Determine the rate of transient synchronization 
failures by observing the number of retries 
attempted at each synchronization point. 

5) Simulate faults (permanent or transient) on the 
control and indicator discretes and determine 
the crew's reaction to these faults- Develop 

a list of actions that the crew should perform 
when these faults are abserved in flight. 

6) Determine the ratio ^Qpc ;/^3 snd see whether Xg 

can be improved with better and more reliable 
circuitry . 


6. CONCLUSION 


This report presented an analysis of the effects of 
discrete failures on the Data Processing Subsystem, The 
analysis included a functional description of each discrete 
together with a list of software modules that use this dis- 
crete. A qualitative description of the consequences that 
may ensue due to discrete failures is given followed by a 
probabilistic reliability analysis of the Data Processing 
Subsystem. Based on the, i nvesti gation conducted, recom- 
mendations were made to improve the reliability of the 
subsystem. 

In the following, some methods are suggested for 
recovering GPCs lost because of synchronization as well 
as other discrete failures. Since in the ALT phase no 
attempts are made lo recover the lost GPCs, these methods 
are applicable only in the OFT phase. Rollback and roll- 
forward techniques can be profitably used to recover GPCs 
out of synchrony and include them in Redundant or Common 
Set computation. In the rollback technique, whenever a 
GPC is lost from the Redundant or Common Set due to tran- 
sient errors, during the SSIP phase all the GPCs reset 
their status to a common reference point in the past v^hose 
status has been stored either in Mass Memory units or GPC 
memory, and resume their computation. This technique 
slows down computation rates and is preferred only when 
speed is not critical. In the roll-forward technique, 
when a GPC fails due to synchronization, instead of remov- 
ing the GPC from the Redundant or Common Set, the correct- 
ly operating GPCs transmit their status and data to this 
GPC, and then all the GPCs resume their computation. This 
technique also has the advantage of recovering the GPCs 
lost due to transient errors, and is faster. These tech- 
niques can be easily incorporated in the present software 
design of the space shuttle to increase the reliability 
of the Redundant and Common Sets. 
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ALT FAILURE MODE EFFECTS ANALYSIS INSTRU- 

RW 

SD74-SH 

i 

i 

MENTATION SUBSYSTEM (9/12/75) 


-0069A 
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Documents on the Space Shuttle (continued): 


NO. 

0051 

0052 

0053 

0054 


TITLE 


ALT FAILURE MODE EFFECTS ANALYSIS DATA 

PROCESSING & SOFTWARE SUBSYSTEM (9/12/75) 

SYSTEM SOFTWARE DESIGN SPECIFICATION 

PART II; ALT DETAILED DESIGN SPECIFICA- 
TION FCOS, USER INTERFACE, AND SYSTEM 
CONTROL (1/30/76) 

UPDATE TO REF. 0052.(2/16/76) 

IN-HOUSE TESTING OF GPC I/O DISCRETE 
CIRCUITS 


DOCUMENT NO. 

RW SD74-SH 

-0071A 

IBM 76-55-0929 

IBM 76-55-0929 

NASA INTERNAL 
NOTE 75-EG-15 
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Ehlers, H. L. and Peller, J. B., "Space Shuttle Guidance, 
Navigation and Control Overview", SAE Aerospace Control and 
Systems Committee Meeting No. 33, Paradise Valley, Arizona, 
May 1976. 

t 
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Shuttle Computers", IBM Journal of Research and Development, 
Vol . 20, No. 1, pp. 30-28, January 1976. 
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V 


i 


LIST OF SPACE SHUTTLE ACRONYMS 
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A - LEFT INPUT TO ALU 

A£P - ATTITUDE AND POINTING 

A/A ~ AIR TO AIR 

A/C - AIRCRAFT 

A/D - ANALOG-TO-DIGITAL 

A/L - APPROACH AND LANDING 

AA - ACCELEROMETER ASSEMBLY 

ACC . - ACCUMULATOR 

ACE - ACCEPTANCE CHECKOUT EtJUlPKENT 

ACM - AQUISITION AND CONTROL MODULE 

ACT - ACTION 

ADS - auxiliary MEMORY DATA UUTPUT BUS 

ADC “ ANALOG TO DIGITAL CONVERTER 

ADC - AIR Data computer 

AOI - ATTITUDE DIRECTOR INDICATOR 

ADL - AVIONICS DEVELOPMENT LABORATORY 

ADP - AUTOMATIC DATA PROCESSING 

ADS - AIR DATA SYSTEM . 

ADT - AIR DATA TRANSDUCER 

ADTA - AIR DATA TRANSDUCER ASSEMBLY 

ADVANCE - MEMORY DATA AVAILABLE SIGNAL 

AGE - AIR/GROUNO EQUIPMENT 

AHP “ PITCH AXIS ATTITUDE HOLD 

AI , - ALTITUDE INDICATOR 

AIB_GPC_LQCATQR GPC LOCATOR {SYSTEM CONTROL MODULE) 

AIC_GPC_STARTUP GPC STARTUP {SYSTEM CONTROL MODULE) 

AID - ANALOG INPUT DIFFERENTIAL 

AIE_SIP SYSTEM INTERFACE PROCESSOR (SYSTEM CONTROL MODULE) 

AIG_DEU_LDADER OEU LOADER (SYSTEM CONTROL MODULE) 

AIU - AVIONICS INTERFACE UNIT 

ALC - AUTOMATIC LIGHT CONTROL 

ALPHA - ANGLE OF ATTACK 

ALT . - APPROACH AND LANDING TESl 

ALU - ARITHHETIC/LOGIC UNIT 

AHEC - AFT MASTER EVENTS CONTROLLER 

AMI - ALPHA/MACH CUNTROLLER 

AMI - AIRSPEED/MACH INDICATORS 

AMT - APPLICATIONS HUOINb TABLE 

AN - ALPHANUMERIC 

AOA - ANGLE UF ATTACK 

ADD - ANALOG OUTPUT DIFFERENTIAL 

APP - APPLICATIONS SOFTWARE 

AFU - AUXILIARY POWER UNIT 

APV - ATTACH POINT VOLTAGE 

GPC SWITCH MONITOR (SYSTEM CONTROL MODULE) 

IDLE OPERATIONAL SEQUENCE (SYSTEM CONTROL MODULE) 

GPC RECONFIGURATION (SYSTEM CONTROL MODULE) 

BUS CONFIGURATION CHANGE (SYSTEM CONTROL MODULE) 

GPC RECONFIGURATION TABLE CHANGE (SYSTEM CONTROL MODULE) 
DPS CUNFIGURATiON ITEM PROCESSOR (SYSTEM CONTROL MODULE) 
GPC RECONFIGURATION MESSAGE HANDLER (SYSTEM CONTROL MODULE) 
SECONDARY GPC RECONFIGURATION (SYSTEM CONTROL MODULE) 
ASA - AEROSURFACE SERVO AMPLIFIER ASSEMBLY 

ASA_IOLE_SPEC IDLE SPECIALIST FUNCTION - SPEC 0-00 (SYSTEM CONTROL MODULE) 

ASB_RO/HRT REAO/hRXTE SPECIALIST FUNCTION (SYSTEM CONTROL MODULE 1 


ARA_GPC_SHITCH 
ARB_IULE_OPS 
ARC_GPC_RECDNFIG 
ARU_BUS_CHG 
ARE_GPC_TAB LE_CHG 
ARF_DPS_CDNFIG_lThH 
ARG^RECONFi b_HSG 
ARH_SEC_gPC_RECONFIG 
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ASC_TIKE_/tGHT ' TIKE MANAGEMENT SPECIALIST FUNCTION (SYSTEM CONTROL MODULE} 
'' ' ASD_OATA_CQNTRQL DATA CONTROL SPECIALIST FUNCTION (SYSTEM CONTROL MODULE) 

V > ASELM - AUXILIARY SELECT SIGNAL 

ASI - AIRSPEED indicator 

; ASLCN - AUXILIARY SAR LOAD CLOCK 

ASP - AEROSURFACE POSITION 

ASPI - AEROSURFACE POSITION INDICATOR 

ATA - AVIONICS TEST ARTICLE 

ATP - ACTIVATION TEST PROGRAM 

ATVCD - ASCENT THRUST VECTOR CONTROL DRIVER 

' AVVl. - ALTITUDE VERTICAL VELOCITY INDICATOR 

• B* - RIGHT INPUT TO ALU 

. BA - BOUNDARY ALIGNMENT 

BAX - BAROMETRIC ALTITUDE INDICATOR 

; BCE “ BUS CONTROL ELEMENT (IN IOP5 

BCH - BOSE, CHAUDHURI, AND HOCUUENGHEH 

BCL - BIT COUNT LATCHED {KIA SIGNAL) 

< BCKUX - BUS CONTROL MULTIPLEXER 

8CPTN - EXTERNAL MEMORY ADDRESS PARITY ERROR SIGNAL 

BDDSN • - BCE DISABLE DISCRETE 

BDHI - BEARING AND DISTANCE HEADING INDICATOR 

BETA “ ANGLE OF SIDE SLIP 

BFC - BACKUP FLIGHT CONTROL 

BFCS - BACKUP FLIGHT CONTROL SYSTEM 

; BFCSED - BACKUP FLIGHT CONTROL ENGAGE DISCRETE 

i BIT - BUILT-IN TEST 

BITE - BUILT-IN TEST EQUIPMENT 

i BHAS - 8DDY-HDUNTED ACCELEROMETER SYSTEM 

i BOF . - BEGINNIf*; OF FILE 

BOT . - BEGINNING OF TAPE 

BP - "READY" RESET 

BPS - BIT PER SECOND 

1 BR - BRANCH 

I BSR - BRANCH SECTOR REGISTER 

BSR - BITE STATUS REGISTER 

■ BSR - BRANCH SECTOR REGISTER 

' ' ; BSYN - MEMORY BUSY SIGNAL 

BTE - BTU ERROR TABLE 

BTO - BLOCK TIME OUT 

BTU - BUS TERMINAL UNIT 

, BU - BRANCH UNCONtvlTlONAL 

BU - BACKUP 

BUM - BITE UPDATE NOTICE 

I BUDU - BACKUP OPTICAL UNIT 

BUSY - MEMORY BUSY SIGNAL 

C - CONTROL 

C£T - COMMUNICATIONS AND TRACKING 

CEH - CAUTION AND WARNING 

C-BUS - COMPUTER DATA BUS 

: C/M - CONTROL MONITOR 

C/T - CONTROL AND TIMING 

C/K - CAUTION AND WARNING 

, CAB - COMPUTER ADDRESS BIT 

I CAB - COMPUTER ADDRESS BUS 

; CADE - CONTRQLLER/ATTITUOE DIRELTUR ELECTRONICS 
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-..pY- 


CALC 

CAH 

CAPRI 

CAPRI 

CARR 

CAS 

CC 

CC 

CC 

CCAT 

CCD 

CCP 

CCR 

CCT 

CCTV 

CD 

CDS 

COD 

CDR 

CDR 

CDW 

CC 

CGD 

Cl 

Cl 

CIA 

CIA 

CH 

CH 

CKD 

CHOS 

CKPTR 

COMPOOL 

CDHSEC 

CONTM 

CP 

epos 

CPEI 

CPU 

CPUFN 

CPUPR 

.^-^CR 

CRT 

GS 

CS5 

CSECT 

eSN 

CSS 

CIS 

eVT 

CW 

cw 

eWEU 

D 

DCC 


CALCULATE 

- COHPUTER ANNUNCIATION MATRIX 

- CAPACITOR RESET INTtGRATOR 

- CAPACITOR rate integrator 

- CUSTOMER ACCEPTANCE READINESS REVIEW 

- COMMAND AUGMENTATION SYSTEM 

- CROSS-COUPLE 

- CHANNEL CONTROLLER 

- COMMUNICATIONS CONTROL 

- CHPTR/CRT assignment TAbLE 

- CONSTANTS CHANGE DISPLAY 

- COMMAND COMPUTER C?) 

- CROSS-COUPLE REGISTER 

- CUv?.RENT CONEIGURATION TABLE 

- CLOSED CIRCUIT TELEVISION 

- COMMAND DECODER HD H 
“ CDHPjLITER DATA BUS 

- CONTIGUOUS data DESCRIPTOR TABLE 

- COMMANDER 

- COMMAND DESIGN REVIEW 

- COMMAND DATA WORD 

- CENTER OF GRAVITY 

- CYCLIC GROUP DESCRIPTOR 

- CONFIGURATION INSPECTION 

- CREW interface 

- CONTROL INTERFACE ASSEMBLY 

- COMPUTER INTERFACE ADAPTER 

- CONTROL MONITOR 

- CONFIGURATION MANAGEMENT 

- COMMAND 

" COMPLEMENTARY HETAL-OXIOE-SEHI CONDUCTOR 

- COHPUTER 

- COMMON DATA POOL AREA 

- COMMUNICATIONS SECURITY 

- CONTINUE SIGNAL 

- CLOCK PULSE 

- COMPUTER PROGRAM OEVELOPbHENT SPECIFICATION 

- computer program end ITEM 

- CENTRAL PROCESSING UNIT 

- CPU FAIL SIGNAL 

- CPU PRIORITY FOR BUS ACCESS 

- CARD READER 

- CATHODE RAY TUBE UN DU) 

- CREW STATION 

- COMPUTER SUPPORT EtiUlPMbNT 

- CONTROL SECTION 

- CHANNEL SELECT NOT (SIGNAL 10 MIA) 

- CONTROL STICK STEERING 

- COMPUTER TEST SET 

- COMMUNICATION VECTOR TABLE 

- CONTROL WORD 

- COMMAND WORD 

- CAUTION AND WARNING ELECTRONICS UNIT 

- DISCRETE 

- DISPLAY AND CONTROL 
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uuR 

0/A 
u/C 
DaCoU 
Dap 

Ob - 

Db 

DbC “ 

DfiG 
Obi 
DdiA 

liBN - 

DC 

DCDJOHNLIST 

ocx_cow_oata 

OCI_LYL_Di SPLAY 
OC|_|-MT_OATA 
OCM 

ijCS^SYNC 
i)D 

ddccs 


DDl_UWN_LST_CUNTROLS 


OiSPLAV INITIATIGN AND RbSPONSE 
DIGITAL TO ANALOG 

display and control 

DIGITAL ACQUISITION AND CUNTROL BUFFER UNIT (PCM MASTER) 

DIGITAL AUTO PILOT 
DATA BUFFER 
DATA BUS 

DATA aUS COUPLER 
DATA BUS GROUP 

DATA BUS INTERFACE UNIT - LAUNCH 
data BUS ISOLATION AMPLIFIER 
DATA BUS NETWORK 
DISPLAY COUPLER 

GPC DOWNLIST FORMATTER (USER INTERFACE MODULE) 

DATA CUNVERSION (USER INTERFACE MODULE) 

CYCLIC DISPLAY PROCESSING (USER INTERFACE MODULE) 

DATA formatting (USER INTERFACE MODULE) 

- DISPLAY AND CONTROL MODULE 

GPC/PCMHU data cycle SYNCHRONIZER (USER INTERFACE MODULE) 

- DECODER DRIVER 

- DEDICATED DISPLAY C CONTROL SYSTEMS 


DDDU 
DDl 
DOM 
OljMaN 
DDU 
QOS 
oou 

ODD 
OEG 
OET 
uEU 
OF 
OPB 
uFl 
OFT 

DGI_LD8„IO 

dgo_ldb_cuoru 
ox 

DIA 
OlH 
OIL 

DlM_lCC_COLLtCTQR 
DIN 
OIPL 


GPC DQNNLIST DATA CONTROLS PROCESSOR (UIM) 


DISPLAY DECODER DRIVER UNIT 
UlSCRETt DIGITAL INPUTS 

oata display HDUULE 

DISABLE DMA SivGNAL 
DISCRETE DIGITAL OUTPUT 
DETAIL DESibN SPECIFICATION 
DIGITAL DISPLAY U^aT 
DISPLAY DRIVER UNIT 
DEGREES 

DIGITAL EVENT TIMER 
DISPLAY ELECTRONICS UNIT (IN HCDS) 

DATA FL&W 

DISPLAY FORMAT BUFFER 
DEVELDPLHENT FLIGHT INSTRUMENTATION 
olSPLAY FORMAT TABLES 

LOB I/O PROCESSOR (USER INTERFACE MODULE) 

LDB OUTPUT MESSAGE COORDINATOR (USER INTERFACE MODULE) 

- UiSCRETE INPUT 

- DISCRETE I/O REGISTER (OF GPC) 

- DISCRETE INPUT HIGH 

- DISCRETE INPUT LOW 


ICC MESSAGE COLLECTOR (USER INTERFACE MODULE) 

- DIRECT-IN INSTRUCTION 

- UISPLAY INITIAL PROGRAM LOAD 

eiS_fLAY DISPLAY PRtStNTATlON AND CONTROL (USER INTERFACE MODULE J 

UISP - DISPLACEMENT 

DISP - DISPLAY FUNCTION 

DIT - OEU INPUT TABLE 

OLC - data load CLOCK, 

OLC - DELAY LINE CONTROL 

OLCN - uATA LOAD CLOCK (TO LOAD SDR} 

uLH_i,0&_RUUT lob HESSABE router (USER INTERFACE MODULE} 

OLT - DEU LOAD TABLE 


RiraODtioBtt.nY OF M 

-PA aw TR POOR 
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DUY 

OH 

DMA 

DKAIN 


- OfcLAV 

- DIODE HATiUX 
“ DIRECT HEMORY ACCESS 

- DMA REQUEST SIGNAL 

DKC_APP_INT application control INTERFACE (USER INTERFACE MODULE) 

OHC_HCDS„CNT HCDS DISPLAY CONTROL (USER INTERFACE MODULE! 

OKC_NEH_DISPLAY NtW DISPLAY PROCESSING (USER INTERFACE MODULE) 

DHC_SEC!_REy_PROC SEQUENCE REQUEST PROCESSING (USER INTERFACE MODULE! 

DMC_SUP£R USER INTERFACE CONTROL SUPERVISOR (USER INTERFACE MODULE) 

DHE - distance MEASURING EQUIPMENT 

OHE_ICC„RaUT ICC MESSAGE ROUTER (USER INTERFACE MODULE) 

Dhl_HCDS_lN HCDS INPUT PROCESSOR (USER INTERFACE MODULE) 

, DHM_KCUS_PROCESS HCDS MESSAGE PROCESSOR (USER INTERFACE MODULE) 

i DHMD - DISPLAY FORMAT HASS MEMORY DIRECTORY 

; DHP_HM_MSG_PRQC MASS MEMORY MESSAGE PROCESSOR (USER INTERFACE MODULE) 

{ DHS - DOCKING MODULE SUfiSYSTEH 

OHS_HSG„LSF » MESSAGE LINE SUPPORT FUNCTION (USER INTERFACE MODULE) 

APPLICATION HODING AND SEQUENCING (USER INTERFACE MODULE) 
DISCRETE OUTPUT 
DEPARTMENT OF DEFENSE 
DISCRETE OUTPUT LOW 
DATA PROCESSING AND SOFTWARE 
DDHNLIST parameter DUMP CONTROL TABLE 
DATA PATH ERROR TABLE 
uATA PATH MASK TABLE 

DATA PROCESSING SUBSYSTEM OR DATA PROCESSING SYSTEM 
DATA REGISTER 
DESTRUCTIVE READOUT 
DELAYED SELECT SIGNAL 
DISPLAY AND KEYEJOARD 
DATA SECTOR REGISTER 
DATA SECTOR REGISTER 
DATA ACKNDHLEOGE SIGNAL 

TIME HOMOGENEOUS DATA REQUEST PROCESSOR (USER INTERFACE MODULE) 


UNX_BMS 
I DO 
iOOD 
IDOL 


DPGS 


DPOC 
ppE 
DPM 
lOPS 
! DR 

|drq 

DSELN 

DSKY 

dsr 
jDSR 
jOTACN 


;DTH_TIME_HaHD 


tOTRQN 

joTS 

;dtvc 

;du 

DWIM 

E 

E/I 

E/H 

EA 

tEACFH 

iEACOH 

Ieas 

jEC 

(ECI 

ihCLSS 

;£CRV 

;EDB 

EH 

ElU 

'bHl 

iEKU 


DATA REQUEST SIGNAL 

- DATA TRANSFER SYSTEM 

- DATA TRANSMISSION AND VERIFICATION CONVERTER 

- display UNIT (IN HCDS) 

- MICRO ASSIST HARDWARE 

- SOURCE (MEMORY DRIVER) 

- SOURCE/SINK (HEMORY DRIVER) 

- ENERGY TO WEIGHT RATIO 

- EFFECTIVE ADDRESS 

- ENGAGE ACTUATOR COMMAND FADING MODULE 

- cLEVON ACTUATOR COMMAND GENERATION MODULE 

- EuUlVALENT AIR SPEED 

- EVENTS CONTROLLER 

- EARTH CENTERED INERTIALS 

- ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM 
~ EXPONENTIALLY CORRELATED RANDOM VARIABLES 

- EXTERNAL DATA BUS 

- ERROR HANDLING 

- engine interface UNIT 

- ELECTROMAGNETIC INTERFERENCE 
" EXTENDED MEMORY UNIT 
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EOF 
j ttJR 
EOT 

: EOMN 

’ EP/MCH 
; EPS 
i Ewe 
! £T 
i ET 
£T 
ETl 
EU 
EU 
EVA 

i EXEC 
i EXEC 
i EXTPK 
' F 
FA 

i FAA 
t FACi 
FAT 
FC 
FC 

FCHL 

FCHASYNU 

FCMbCEHD 

FCHDHAN 

FCKuHASK. 

FCMaUSt-M 

FCKCSYNC 

FcMulSAb 

FCHOISTR 

FCHDSSTK 

FCHENRCV 

FCHENSlft 

FCMENTK 

FCMFOI 

FCHINHMK 

rCKlNSSL 

FCmSYNC 

FCHLINIT 

FEMMOSTR 

FLHHtPK 

FCMNINIT 

FCHPiNIT 

FCHPHOU 

FCMPOVLY 

ruMRELS T 

FCrtSATCN 

FOMSFALL 

FCHSSYNC 

FCMSVC 

FCMTSYNC 

FCUS 


- END OF FILE 

- END OF REFRESH 

- ENU OF TAPE 

- tND OF WORD NOT tSlLNAL FROrt rtiA TO LRUJ 

- EXTENDED PERFORMANCE/HODOLAR CORE KEKORY 

- ELECTRICAL POWER SYSTEH 

- EVENT QUEUE ELEMENT 

- external TANK 

- ELAPSED TIME 

- ELAPSED TIME 

- ELAPSED TIME INDICATOR 

- ENGINEERING UNIT 
“ Electronics unit 

- EXTRAVEhICUUR ACTIVITY 

- EXECUTE 

- tXECUTlVE 

- external PRIORITY FOR BUS ACCESS 

- FLOATING POINT 

- FLIGHT AFT 

- FALSE ALARM AVOIDANCE 

- FIRST ARTICLE CONFIGURATION INSPECTION 

- FLIGHT attitude TABLE 

- FLIGHT CONTROL 

- FLIGHT COMPUTER 

- FLIGHT CONTROL HYDRAULICS LABORATORY 

- INITIAL SSIP SYNCHRONIIATIUN JFCDS MODULE) 

- USER MODIFICATION OF bCE CHAINS <FCQS MODULE) 

- UStR/GROUND REuUESTLD RECONFIGURATION (FCOS MODULE) 

- iJUS/DATA path mask HANAGEHcNT (FCOS MODULE) 

- USER/GROUND REQUESTED RECONFIGURATION {FCOS MODULE) 

“ NORMAL SSIP SYNCHRONIZATION (FCOS MODULE) 

- DISABLE transmitter RtLElVtR SUBROUTINE 

- DISABLE transmitter SUBROUTINE 

- DISABLE STRING SUBKUUl INt 

- ENAoLE receiver SueKOUTlNE 

- ENABLE string SUBROUTINE 

- enable transmitter SUBROUTINE 

- FAULT detection IOLmTIFILATION <FC0S MODULE) 

- Read uluck from mm routine 

- system software loader (FCUS MODULE J 

- I/O SYNCHRONIZATION (FCOS MODULE) 

- ONE TIME INITIALIZATIDN ROUTINE 

- MODE STRING SUBROUTINE 

- HEC-blU PORT MANAGEMENT SUBKUUTINE 

- NORMAL INITIALIZATION (FCOS MODULE) 

- POWER TRANSIENT INIT lALtZAl ION (FCOS MODULE) 

- PROGRAM HUDIFICATION (FCOS MODULE) 

- PRUGRAM OVERLAY (FCOS MuDULE) 

- RELEASE STRINGS SUBROUTINE 

- NOMINAL STRING ASSIGNMENT SUBROUTINE 

- SYNC FAIL PROCESSDR (FCOS MODULE) 

- SVC SYNCHRONIZATION (FCOS MODULE) 

- CONFIGURATIUN MANAGEMENT SVC SERVICING (FCOS MODULE) 

- TIMER SYNCHhONIZATiUN (FcuS MODULE) 

- flight computer operating SYSTEM 
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^ FCGS . 

! FCb 
FCSM 
FCH 
i FD 
j FGA 
i FuaK 
1 FDI 
FOIR 
I FDH 
I FOS 
* FFID 
FhT 
FF 

! FHF 
i FI 
\ FIFO 
! FIOBCFRR 
I FIOCiPR 
: FIQCMPl-T 
: FIOCTDPE 
I FIQFRRLA 
! FIDERRLB 
! FlOEkRUC 

! fidfcmpt 

- FXOHLTMM 
: FIOICCF 

; FIOLGERR 
I FIOHCIWT 
FIQHCHPT 
I FiaMCNTL 
: FIOHHCHP 
: rlQHMCV 

- FIOHMDSP 
FIQMMMGR 

: FlDrtMHSC 
: rIOHHPXI 
; FXUHHSTR 
FIOriHTHR 
FlGMMTgfc 
; FIQHNTR 
^ FXQMFSDO 
■ FIOKRAW 
: FIDMSCTO 
i FIGMSFTB 
FIUMSFD 
i FiaNCHPT 
s FIOPDISP 
j FIOFROT 
] FIOPSDTD 
j FlDPURGt 
' FlGRtSET 
: FIORSLV 
^ FIGSVC 
; FKB 


- FLIGHT CGMTKOL OPERATIONAL SOFTWARE 

- FLIGHT CONTROL SYSTEM 

- FLIGHT CONTROL SUbROUTlNE HOOULE 

- FORMAT CONTROL WORO (FOR DISPLAY) 

- FAULT DETECTION 

“ FAULT DETECTION ANNUNCIATION 

- FEEDBACK 

- FAULT DETECTION AND IDENTIFICATION 

- FAULT DETECTION IDENTIFICATION AND RECOVERY 
" FREQUENCY DIVISION MULTIPLEXER 

- FUNCTIONAL DESIGN SPECIFICATION 

“ FLIGHT EQUIPf(ENT INI ERFACt DEVELOPEMENT 

- FIELD“EFFECT TRANSISTOR 
“ FLIGHT FORWARD 

- FIRST horizontal FLIGHT 

- FAULT IDENTIFICATION 

- FIRST-IN-FIRST'-DUT 

- bCE NO/GO PROCEDURE 
“ IPR SUBROUTINE 

- COMPLETION PROCESSING (FCDS MODULE) 

- COUNT DATA PATH ERROR PROCEDURE 

- I/O ERROR HANDLER, LEVEL A (FCDS MODULE) 

- I/O ERROR HANDLER, LEVEL 6 (FCOS MODULE) 

" I/O ERROR HANDLER, LEVEL C (FCOS MODULE) 

" ERROR completion SUBROUTINE 

- MASS MEMORY HALT PROCESSOR (FCOS MODULE) 

- ICC FAILURE SUBROUTINE 

- I/D ERROR LOG. PROGRAM (FCOS MODULE) 

- MSC I/O MONITOR ENTRY POINT 

- HSC I/O MONITOR ENTRY POINT 

" MSC CONTROL PROGRAM (FCOS MODULE] 

- MM COMPLETION PROCESSING SUBROUTINE 

- HM checksum VERIFICATION SUBROUTINE 

- HM INITIATE RBcjUEST SUBROUTINE 

- MASS MEMORY MANAGEMENT ROUTINE fFCOS MODULE) 

- HASS MEMORY HSC ROUTINE (Fed'S MODULE) 

- MH PROCESS INCOMING IOQE*S SUBROUTINE 

- HH ATTEMPT TO START REQUEST SUBROUTINE 

-- m MONITOR outstanding requests subroutine 

- MH BUILD AND CHAIN TQE SUBROUTINE 
-HSC I/O MONITOR PROGRAM (FCOS MODULE) 

- HSC PSEUDO BUSY PROGRAM (FCOS MODULE) 

-* HSC I/O MONITOR ENTRY POINT 

- HSC TIMEOUT PROCEDURE 

- HSC BCE RESET PROGRAM (FCDS MODULE) 

- SET FAIL DISCRETES PROGRAM (FCOS MODULE ) 

- NORMAL COMPLETION SUBROUTINE 

- XOP DISPATCHING (FCOS MODULE) 

- PROTECTED TRANSACTION SUBROUTINE 

- MSC PSEUDO TIMEOUT PROCEDURE 

- TEKHXNATXON PROCESSING (FCOS MODULE) 

“ irrr reset procedure 

- MASS MEMORY CONTENTION RESOLUTION ROUTINE (FCOS MODULE) 

- I/O SVC SERVICING (FCDS MODULE) 

- FLIGHT DISPLAY KEYBOARD 



; FLR “ FLIGHT LOG RECORDER 

; FH - FREQUENCY KOQULATIUN 

i FHEC - FORWARD MASTER EVENTS CONTROLLER 

; FO/FS - FAIL OPERATIONAL/FAIL SAFE 

; FQF - FIRST OPERATIONAL FLIGHT 

FOV - FIELD OF VIEW 

FP - FIXED POINT 

FP - FLOATING POINT 

FPHCANCL -* cancel PROCESSING tFCOS MODULE) 

FPHCLOSE - CLOSE PROCESSING (FCOS MODULE) 

FPHDISP ~ PROCESS DISPATCHING (FCOS MODULE) 

FPMERLOG - ERROR LOGGING I FCOS MODULE) 

FPKEVAL - EVENT EVALUATOR IFCQS MODULE) 

FPHEVDEQ - EVENT DEQUEUE PROCESSING (FCOS MODULE) 

FPHEVENQ - EVENT QUEUE GENERATION (FCOS MODULE) 

FPKFCLOS - FORCED CLOSE PROCESSING tFCOS MODULE) 

FPMIEPCT “ 1NHIQIT/ENA3LE APPLICATION PROCESSES (FCOS MODULE) 
FPHIHIM - iNSTRUCTIoft MONITOR INTERRUPT HANDLER (FCOS MODULE) 
FPMIHMC - MACHINE CHECK INTERRUPT HANDLER (FCOS MODULE) 

FPHIHPCZ - TIMER QUEUE ELEMENT EXPIRATION (FCOS MODULE) 

FPHIHPGH - PROGRAM INTERRUPT HANDLER tFCOS MODULE) 

FPMHTURH - MTU REDUNDANCY )(ANAGEHENT tFCOS MODULE) 

FPMOPSCN OPS CANCEL PROCESSING tFCOS MODULE) 

FPKREL - RELEASE RESOURCE LOCK tFCOS MODULE) 

FPMRES - RESERVE RESOURCE LOCK (FCOS MODULE) 

FPHRESET - SET EVENT STATE TO FALSE tFCUS MODULE) 
i FPMSCHED - PROCESS SCHEDULING (FCOS MODULE) 

I FPMSDERR - PROCESS ERROR RECOVERY (FCOS MODULE) 

■ FPMSET ^ - SET- EVENT- STATE TQ TRUEVtFCOS MODULE) 

! FPKSIGNL - PULSE EVENT STATE (FCOS MODULE) 

'■ FPHSTAT - PRIO FUNCTION (FCOS MODULE) 

! FPHSTAT - - APPLICATION ..ERROR number REQUEST (FCOS MODULE) 

! FPKSVC -SVC HANDLING tFCOS .MODULE! . - : 

i FPMSHTCH - PROCESS SWITCHING (FCOS MODULE) 

' FPHTERH - TERMINATE PROCESSING I FCOS MODULE) 

I FPHTHDEQ - TIMER DEQUEUE PROCESSING (FCOS MODULE) 
j FPMTMENQ - TIME QUEUE GENERATION (FCOS MODULE) 

i FPHTMHAL - APPLICATIONS REQUESTS FOR TIKE AND DATE (FCOS MODULE) 
i FPHUPMTU - MASTER TIMING UNIT UPDATES (FCOS MODULE) 
i FPMUPRIO - UPDATE PRIORITY FUNCTION (FCOS MODULE) 

I FPMWAIT -WAIT PROCESSING (FCOS MODULE) 

f FRL - FRAME REFERENCE LINE - 

; FRT - FLIGHT READINESS TEST 

FRT - FREQUENCY RESPONSE TEST 

FS - FAULT SUMMARY 

FS - FULL SCALE 

FSP - FAULT summary PAGE 

FSRR - FLIGHT SOFTWARE READINESS REVIEW 

FSSR -FUNCTIONAL SUBSYSTEMS SOFTWARE REQUIREMENTS DOCUMENT 

; FSW - FLIGHT SOFTWARE- PACKAGE 

i FTP - FUNCTIONAL TEST PROGRAM 

I FVF - FIRST VERTICAL FLIGHT 

FW - FULLHORO 

I G - GRAVITY 

I GKC - GUIDANCE AND CONTROL 

! 


/ 
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! bl.N 
^ GC 
i GCHN 
1 GUKCIN 
i GMl 

I GN&C 
1 GNU 

' GPC 
t GPTt 
I GPIN 
I uRON 
GRT 
GSb 
GSIU 
1 GST 
i H/H 
) HAG 
I HAL/S 
! HTT 
j HGa 
I HSl 
HSP 

I oW 
1 

1/U 

lA 

lA 

IAS 

' ItlCKUX 
; IfcH 
; 1C 
! ICC 
! ICC 
ICC 
ILU 
10 
ID 

IDPS 

IMH 

IHS 

IHS/PDFi 

IHT 

IMU 

INTRPT 
IGA 
IDB 
IGH 
I UP 

lOPIWS 

lOPT 

lUQb 

IPL 

IPLG 

IPLS 

I PR 


- GUIDANCE AND NAVIGATION 

- GENERAL COHPUTtR 

- GATE COMMAND MURO SIGNAL 

- GATED LOCKOUT SIGNAL (IPL MODE) 

- GREENWICH MEAN TIME 

- GUIDANCE, NAVIGATIUN AND CUNTROL 

- GROUND 

- GENERAL PURPOSE COMPUTER (CPU AND lOP) 

- GENERAL PURPOSE TEST EwUlPHENT 

- GRANT PRIORITY 1 TU DMA 

- trATE TRI-STATE DRIVERS SIGNAL 
“ GPC reconfiguration TABLE 

- GROUND support EQUIPMENT 

- GROUND STANDARD INTERFACE UNIT 
-GPC status Table 

- hardware 

- HEADING alignment CYLINDER 

- PROGRAMMING' LANGUAGE 

- HOKliONTAL FLIGHT TEST 

- high Gain ANTENNA 

- HORIIONTAL SITUATION INUICaTION 

- HYDRAULIC SYSTEM PRESSURE 

- halfword 

- SINK I MEMORY DRIVER) 

- INPUT/OUTPUT 

- INDIRECT ADDRESS 

- INPUT AXIS 

- INDICATED AIRSPEED 

- INNER BUS CONTROL MULTIPLEXER 

- international BUSINESS MACHINES 

- INSTRUCTION COUNTER 

- INTERCOMPUTER CQMMUNiCATiaNS 

- INTERCOMPUTER CHANNEL 

- INTER-CUKPUTER CHANNEL ( FCOS MODULE) 

- INTERFACE CONTROL DOCUMENT 

- INSIDE diameter 

- IDENTIFICATION NUMBER 

- INTERFACE DIGITAL PRUCESSOR 

- IMMEDIATE 

- inhibit main store 

- INHIBIT MAIN STQKEyPQWEK ON RESET SIGNALS 

- ICC MESSAGE TABLE 

- INERTIAL measurement UNIT 

- INTERRUPT 

- I/O adapter 

- I/D BOX 

- INPUT/OUTPUT MODULE 

- input/uutput processor 

- INPUT/DUTPUT PROCESSOR INHIBIT MAIN STORE 

- PCHMO I/O PARAMETER TABLE 

- INPUT/OUTPUT QUEUE ELEMENT 

- INITIAL PROGRAM LO AO 

- INITIAL PROGRAM LOAD COMPLETE 

- INITIAL PROGRAM LOaD START 

- INPUT PROBLEM REPORT 
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; laiG 

i T CC 


i ITD 
! lU 
lUA 
IVA 
jCL 
JED 
Kb 

KBPS 
KbU 
KBUA 
KH/HR 
* KOPS 
! KVT 
KYBD 
L/D 
LBK 
LC 
LCG 
LCKD 
LCOM 
LDA 
LDQ 
j LDS 
! LGT 
\ LtS 
! . Loa : 
i LPS 
: LPS 

! LRE 
i LRECL 
! LRH 
! LRU 
1 LS 
; LS 
LSB 
LSI 
LTE 
LTOR. 
LVDT 
H 

HA 
MACH 
MACRO 
HACT 
HAEP 
HAL 
MAT 
HBUS 
I HC 
KCDS 
} HCHRN 


- INTER-RANGE INSTRUHENTAT1L.N GROUP TELEMETRY STANOARuS 

- INHIBIT/DVERRIDE SUHHAkY SNAPSHOT DISPLAY 

- INTEGRATtO TEST AREA 

- INITIAL TIMEOUT 

- INTERFACE UNIT 

- INTERFACE UNIT ADDRESS 

- INTRAVEHICULAR ACTIVITY 

- JOB CONTROL LANGUAGE 

- JULIAN hPHEHERlS DATA 

- REYBOARO 

- KILOBITS PER SECOND 

- KEYBOARD UNIT UN HCDS) 

- KEYBOARD UNIT ADAPTER 

- KILOMETER/HDUR 

- THOUSANDS OF UPERATIONS PER SECOND 

- KEYBOARD VERIFICATION TABLE 

- KEYBOARD , 

- LIFT TO DRAG 

- LOAD Base register 

- INDUCTOR-CAPACITOR 

- LOAD CKOSS-COUPLE REGISTER 

- LRU COMMAND SIGNAL TO HlA 

- LOGIC control output MODULE 

- LRU DATA AVAILABLE SIGNAL ID HlA 

- LAUNCH DATA BUS 

- LANDING/OECELERATION SUBSYSTEM 

- LOCK GROUP TABLE 

- LEFT INBOARD 

- LEFT Outboard . ' ' ; • 

- LAUNCH PROCESSOR SYSTEM 

- LOAD PROGRAM STATUS 

- LRU RECEIVE ENABLE SIGNAL TO MIA 

- LOGICAL RECORDS OF FIXED LENGTH . • 

- LRU RESET SIGNAL TO HIa 

- LINE REPLACEABLE UNIT 

- LOCAL STORE 

- LAUNCH SEQUENCE PROCESSOR 

- LEAST SIGNIFICANT BIT 

- LARGE-SCALE INTEGRATION 

“LRU TRANSMIT ENABLE SIGNAL TO HIA 

- LOAD TIMEOUT REGISTER 

- LINEAR VOLTAGE DIFFERENTIAL TRANSFORMER 

- METERS - 

- MICRO architecture 

- milliahpere 

- VELOCITY RELATIVE TO THE SPEED OF SOUND 

- MERGE AND CORRELATE RECUROED OUTPUT 

- MISCELLANEOUS APPLXCATiON CONTROL TABLE 

- MINIMUM AUTOLAND ENTRY POINT 

- MALFUNCTION 

- HCDS ALLOCATION TABLE 

- main BUS 

- MACHINE CHECK INTERRUPT 

-MULTIFUNCTION CATHODE RAY TUBE DISPLAY SYSTEM 

- MACHINE RESET SIGNAL 


I 


1 


1 

f 

I 

i 

i 

r 

! 

f 

f 

\ 


HCIU 

HCIU 

HCHIN 

HCHZN 

HC14N 

MC15N 

HDti 

HDH 

HDM 

HDK 

HE 

HEC 

HtCO 

MET 

ME 

HFQ 

MIA 

Mia 

MH 

MHHG 

HML 

HHU 

mdh 

HPOR 

MPS 

MPS 

MSB 

HSBLS 

rtSC 

MSC 

MSG 

MSI 

HSS 

HSU 

HT 

HTC 

MTO 

MTS 

MTS 

MTU 

HUBN 

HUX 

N/A 

N/L 

NAS 

NASA 

NAV 

NEP 

NMI 

NOP 

mz 

NSAT 

NSP 

NWS 

□ASCB 


- MANIPULATOR CONTROLLER INTERFACE UNIT 

- MASTER CONTROLLER IMTERFACL UNIT 

“ EXTERNAL MEMORY CONFXGURATIDM DISCRETE 

- external memory configuration discrete 

- EXTERNAL HEHDRY CONFIGURATION DISCRETE 
" EXTERNAL MEMORY CONFIGURATION DISCRETE 

- MAIN HEMQRYf DATA OUTPUT BUS 

- MODULATOR OEHODULATOR 

“ MULTIFLEXER/DEHULTXPLEXER 

- MIA DATA READY SIGNAL TO LRU 

- MAIN ENGINE 

“ MASTER EVENTS CONTROLLER 
« MAIN ENGINE CUTOFF 

- MISSION ELAPSED TIME 

- MAJOR FUNCTION 
MULTIFUNCTION OVERLAY 

- MULTIPLEXER INTERFACE ADAPTER 

- MULTILAYER INTERCONNECTION BOARDS 

- MASS MEMORY 

- HILLIHETERS of MERCURY 

- HASS MEMORY UNIT 

- MOMENTARY 

- MASTER PQWER-QN RESET 
*- MODULAR POWER SUPPLY 

" MAIN PROPULSION SYSTEM 

- MOST SIGNIFICANT BIT 

“ MICROWAVE SCAN BEAM LANDING SYSTEM 
“ MASTER SEQUENCE CONTROLLER UN lOP) 

- MOOING, SEQUENCE AND CONTROL 

- MESSAGE 

- MEDIUM-SCALE INTEGRATION 

- MISSION SPECIALIST STATION 

- HASS STORAGE UNIT 

- MISSION TIME 

- MASTER THRUST CONTROLLER 

- &CE MAXIMUM TIMEOUT 

- HICROPROGRAHMED TEST SYSTEM 

- MAGNETIC TAPE SYSTEM 

- MASTER TIMING UNIT 

- MXA busy NOT SIGNAL TO LRU 

“ multiplexer 

- NOT APPLICABLE 

- morhal/lateral 

- NQNAVIONICS SIMULATORS 

- NATIUNAL AERONAUTICS AND SPACE ADMINISTRATION 

“ navigation 

- NORMAL ENTRY POINT 
“ NAUTICAL MILES 

-- NO OPERATION 

- NON-RETURN-TO-ZERD 

- NOMINAL STRING ASSIGNMENT TABLE 

- NETWORK SIGNAL PROCESSOR 

- NOSEWKEEL STEERING 

- ORriXTER AVIONICS SOFTWARE CONTROL BOARD 
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occ 

QO 

ODG 

ODR 

OF 

OFI 

OFP 

QFST 

QFT 

01 

QMS 

OP 

OPS 

QVC 

P/L 

P/N. 

P/S 

P/S 

PACH 

PBAN 

PBI 

PC 

PCS 

PCI 

PCH 

PCKMU 

PCO 

PCSH 

PCT 

POE 

POI 

PDR 

PE 

PE 

PEA 

PET 

PFCR 

PFCS 

PGS 

PHS 

PI 

PIC 

PL 

PLD 

PLD 

PLH 

PLH 

PLT 

PM 

PM 

PHAD* 

PKIA 

PHS 

FHU 

PO 


- OVERCURRENT COMPARATOR 

- OUTSIDE DIAMETER 

- OUTPUT DATA GaTE (?) 

- OUTPUT DATA REDUNDANCY 

- ORBITAL FLIGHT 

- OPERATIONAL FLIGHT INSTRUMENTATION 

- OPERATIONAL FLIGHT PRUGKAM 

- OFFSET 

^ ORBITAL FLIGHT TEST 

- operational instrumentation 

- ORy^THR maneuvering SUBSYSTEM . 

- OPERATION 

“ OPERATIONAL SEQUENCE 

- OVERVOLTAGE COMPARATOR 

- PAY LOAD 

*- POSITlVE/NEGATlve 

- POWER SUPPLY 

- parallel tOj serial converters 

- PITCH AXIS CONTROL KODULt 

~ POLYBUTADIENE ACRYLONtTRlLE 

- pushbutton indicator 

- PROGRAM counter 

- PRINTED CIRCUIT BOARD 

“ PROGRAM CONTROLLfcD INPUT 

- PULSE CODE MODULATION 

- PULSE CODE MODULATION MASTER UNIT 

- PROGRAM CONTROLLED OUTPUT 

- PITCH AXIS CONTROL SUBMODULE 

- PROCESS CONTROL TABLE 

- PROCESS DIRECTORY ENTRY 

- payload data interleaver 

“ PRELIMINARY DESIGN REVIEW 

- PROGRAM EXCEPTION INTERRUPT 

- PARITY ERROR 

- PRELIMINARY EFFECTIVE ADDRESS 

- PHASED TIME ELAPSED 

- PRIMARY FLIGHT CONTROL RESET 

- PRIMARY FLIGHT CONTROL SYSTEM 

- POWER GENERATION SUBSYSTEM 

- PAYLOAD HANDLING STATION 

- PUT-AWAY INITIALIZATION 

-- PYRO INITIATOR CONTROLLER 

- payload 

- PAYLOAD 

“ PROGRAM LISTING DOCUMENT 

- PAYLOAD MANAGEMENT 

- PAYLOAD MONITORING 
" PILOT 

- PERFORMANCE MONITOR 

“ PERFORMANCE MANAGEMENT 

- PERFORMANCE MONITOR ANNUNCIATOR DRIVER 
“ PARrtLLEL MULTIPLEXER INTERFACE ADAPTER 

- PERFORMANCE MONITORING SYSTEM 

- PCM C PULSE CODE HODULATIONI MASTER UNIT 

- POWER ON 
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PD 

POD 

POl 

POID 

PQIt 

PDR 

PRD 

PRP 

PRl 

PRIO 

PRO . 

PROH 

PS 

PSA 

PSA 

P5B1T 

PSP 

PSM 

PTD 

PUT 

PVT 

PWR 

R 

R/H 

R/M 

RA 

RACH 

RAD 

RAI 

RALT 

RAH 

RAW 

RC 

RCC 

RCS 

RCS 

ROD 

RDL 

RDP 

RDS 

ROW 

RHC 

RfcGCLK 

RET 

RF 

RFD . 

RFI 

RG 

RGA 

RGT 

RHC 

R1 

RIB 

RIB . 
RICC 


- PARAMETER OVERRIDE DISPLAY 

- POWER OM/QFF INTERRUPT 

" POWER OFF INTERRUPT OELAYfcU 

- POWER SUPPLY INHIBIT LINE 
« POWER-ON RESET 

“ PROGRAM REUUlRErtENTS QOtUHENT 
~ PULSE REPETITION FREQUENCY 

- PRIMARY 

- PRIORITY FUNCTION 

- PROCEED 

- programmable read-only hemohy 

- POWER SUPPLY 

- PREFERRED STORAGE AREA 

- PREFERRED STORAGE AREA 

- POWER SUPPLY BUILT-IN TEST 

- PAYLDaO signal PROCESSOR 

- PROGRAM STATUS WORD 

- PROGRAk TESTING DOCUMENT 

- POWER UP TRIGGER I?) 

- PRESSURE VOLUME TEMPERATURE 

- POWER INTERRUPT 

- REPEAT 

- READ/WRITE 

- RADAR ALTIMETER 

- ROLL AXIS CONTROL MODULE 

- RADIANS 

- radar altimeter INDICATOR 

- radAr altimeter 

~ random access memory 

- REPEAT UNTIL ALL BCES ARE WAITING 

- RESISTOR-CAPACITOR 

- REDUNDANCY CONNECTION CONTROL 

- RECEIVED COMMAND SYNC SIGNAL FROM MIA TO LRU 

- REACTION CONTROL SYSTEM 

- RE4JJIREKENT DEFINITION DOCUMENT 

- RECEIVE DATA LONG (FORMAT) 

- REQUIREMENTS OEVELOPEMENT PLAN 

- RECEIVE DATA SHORT (FORMAT) 

-RESPONSE DATA WORD (FROM DEUJ 

- RECEIVE 

- REGISTER CLOCK SIGNAL FROM MIA TO LRU 

- RETURN 

- RADIO FREQUENCY 

- requirement formulation document 

- RADIO FREQUENCY INTERFERENCE 

- RATE GYRO 

- RATE GYRO ASSEMBLY 

- RATE GROUP TABLE 

- ROTATIONAL HAND CONTROLLER 

- REGISTER IMMEDIATE 

- RESET INDICATOR BIT 

- RIGHT INBOARD 

- REMOTE INTEKCQMPUTER COMMUNICATIONS INTERFACE 


EEPBODUCiBllJTY f)}- 1 
ORIGINAL PAGK IS Pv() 


RJOA 

RJDF 

RJOD 

RH 

RMC 

Roa 

RQH 

RQS 

ROSAR 

RQSBR 

ROSDR 

RPH 

RPTA 

RR 

RR 

RREU 

RS 

Ra 

RSIFN 

RTC 

RTCE 

RTLS 

RHH 

S 

s 

S/C 

s/0 

S/tf 

SACS 

SAIL 

SAR 

SAT 

SATS 

SB 

SBAS 

SBHC 

SBMC 

SBTC 

SC 

SC 

SC 

sea 

sec 

SCLN 

SCH 

scrt 

SCM 

SeSN 

SCT 

SCU 

sew 

SDAf4 

SOF 

SOL 


- REACTION JET DRIVER AFT 
REACTION JET DRIVER FORWARD 

“ REACTION JET QMS DRIVER 

- REDUNDANCY HANAGEHENT 

- REOUNOANCY MANAGEMENT CONTROL 

- RIGHT OUTBOARD 

- READ-ONLY MEMORY 
“ READH3NLY STORE 

“ READ ONLY STORE ADDRESS REGISTER 

- MICROPROGRAM LINlt REGISTER 

- READ ONLY STORE DATA REGISTER 
~ REVOLUTIONS PER MINUTE 

- RUDDER PEDAL TRANSDUCER ASSEMBLY 
“ REGISTER TO REGISTER 

- RENDEZVOUS RADAR 

- RENDEZVOUS RADAR ELECTROrUCS UNIT 

- REGISTER TO STORAGE 

- redundant SETS 

- REDUNDANCY STATUS 

- RESET INTERFACE SIGNAL 
" REAL-TIME COMMAND 

- ROTATION AND TRANSLATION CONTROL ELECTRONICS 

- RETURN TO LAUNCH SITE 

- READ/WRITE MEMORY 
« SIGN BIT 

- POWER TRANSIENT FLAG CIN RDM) 

- SIGNAL CONDITIONER 

- SKELETON/DYNAHIC 

- SOFTWARE 

- SYSTEM SOFTWARE AVIONICS COMMAND SUPPORT 

- SHUTTLE AVIONICS INTEGRATION LABORATORY 

- STORAGE ADDRESS REGISTER 

- STRING ASSIGNMENT TABLE 

- SHUTTLE AVIONICS TEST SYSTEM 

- SPEEDBRAKE 

- S-BAND antenna SWITCH 

- SPEEDBRAKE HAND CONTROLLER 

- SPEEDBRAKE MANUAL CONTROL 

- SPEEDBRAKE THRUST CONTROLLER 

- SUPERVISOR CALL INTERRUPT 

- STORAGE COMPLETE {FOR POWER DOWN) 

- SYSTEM CONTROL SOFTWARE 

- SOFTWARE CONTROL BOARD 

- SCH COMPARISON DISPLAY 

- STORAGE ADDRESS REGISTER LOAD LOCK 

- SUBSYSTEM CONFIGURATION MANAGEMENT 

- SUBSYSTEM CONFIGURATION MONITORING 

- SYSTEM CONTROL MODULE 

- SPLIT CYCLE STORE COMMAND LINE 

- subcdh table 

- SEQUENCE CONTROL UNIT 

- SEARCH COMPLETE WORD 

- BIT COUNT ERROR SIGNAL FKUM MIA TO LRU 

- SIMULATION DATA FILE 

- SOFTWARE DEVELOPMENT LABORATORY 
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SUK 

- 

MORAUfc data KtGiSTER 

SUR 


SERifcS UISSlPATlVt P.E&ULATUR 

SUK 

— 

SUFTWARE DESIGN KfcQUiHtHbMTS 

SOS 

— 

SHUTTLE DYNAMICS SIHULATUR 

SDT 

— 

STRING DtFlNITIUN TABLE 

SbLN 

- 

SELECT IHEHORY INITIATE SIGNAL) 

StCiNG 

— 

SE0UENC1N6 

SfcV 

— 

MESSAGE VALIDITY TEST 

SF 

— 

SCALE FACTOR 

SF 

— 

SELECTIUN FILTER 

SFC 

— 

SELCTION FILTER CONTROL 

SG 

— 

SYMflUL GENERATION 

5.GLS 

— 

SPACE-GROUND LINK SUBSYSTEM 

5HS 

— 

SIMULATION HARDWARE SYSTEM 

Si 

— 

STORAGE IMMEDIATE 

SIB 

- 

SET indicator BIT 

SIM 

“ 

SIMULATION 

SlU 

“ 

SERIAL I/O 

SiP 

— 

SYSTEM INTERFACE PROCESSOR 

SM 

- 

SYSTEM MANAGEMENT 

SMuM 

— 

SMALL MODULAR CORE MEMORY (IN DEU) 

SMRO 

— 

SPIN MOTOR RUN OIRECTOR/D IRECTIDN 

SMSC 

- 

SOFTWARE MOOING* SEtlUENClNG AND CONTP.OL 

SMT 


STRING MODE TABLE 

sues 

- 

SUBSYSTEM OPERATING AND CHECKOUT SYSTEM 

SUP 


SOFTWARE OPERATING PROGRAM 

SUH 


STATEMENT OF WORK 

SPOBK 

— 

SPEEDBRAKE 

SPEC 

— 

SPECIALIST FUNCTION 

SPGAI 


SURFACE POSITION GIHBAL ANGLE INDICATOR 

SPI 

— 

SURFACE POSITIDN INDICATOR 

SPU 


SCRATCH PAD LINE 

SPU 

-* 

SMALL PROCESSOR (IN DISPLAY CONTROLLER) 

SM 

- 

SUPER ljUEUE 

SK5 

— 

SOLID ROCKET BOOSTER 

SKM 

- 

SOLID ROCKET MOTOR 

SKS 

“ 

SHORT REGISTER TO STORAGE 

SkU 

■ — 


SSAU 

-- 

SOFTWARE SYSTEM ANALYSIS DOCUMENT 

SSu 

-- 

STORE STATUS AND CLEAR 

sso 

— 

SPACECRAFT SOFTWARE DIVISION 

SSOD 

- 

SOFTWARE SYSTEM DESIGN DOCUMENT 

SSIP 

— 

SYSTEMS SOFTWARE INTERFACE PROCESSING 

SSL 


SYSTEM SOFTWARE LOADER 

ssa 

— 

SYSTEMS SOFTWARE OFFICE 

ssw 

- 

STORE STATUS AND WAIT 

ST 


STAR TRACKER 

STAOU 

- 

SYSTEM TERMINATION AND DISPLAY UNIT 

STUN 

— 

SPACE TRACKING AND DATA NETWORK 

STP 

- 

SELF-TEST PROGRAM 

STPIN 

— 

STOP CONTROL SIGNAL 

STP2N 

— 

STOP CONTROL SIGNAL 

STRCN 

- 

DMA STORE CONTROL SIGNAL 

STRN 

- 

PURE STORE control SIGNAL C EXTERNAL MEMORY) 

STkPN 

— 

STORE PROTECT SIGNAL 


: SVC 
SYRN 
SYS 
T/F 
T/R 
TAG 

tacan 

TACFM 
TAEK 
TAS 
TAT 
TATI 
TB 
T6D 
TCS 
TCS 
TCS-S 
TCS-1 
TCV 
TDL 
TDRS 
TDRSS 
TUS 
TFL 
TFOV 
TFS 
TGAP 
THC 
THCB 
! THXK 
TiCH 
TLM 
TKP 
TD 
TUG 
Ti4t 

TR 

TRANS 
i TkSD 
I TSEN 
! TSW 
TTL 
TTY 
TV 
TVC 
TVCU . 
UCP 
UDP 
UDSB 
UHF 
UI 
UlH 
U7C 


- SUPERVISOR CALL INSTRUCTION 

- SYSTEH RESET SIGNAL 

- SYSTEM INTERRUPT 
" TRUE/FALSE 

“ TRANSMIT/RECEXVE 

- TACAN INPUT CARD 

- TACTICAL AIR NAVIGATIUN 

- TAKEOVER ACTUATOR CGHrtAND FADING MODULE 

- TERMINAL AREA ENERGY MANAGEMENT 

- TRUE AIRSPEED 

- TOTAL AIR TEMPERATURE 

- TOTAL AIR TEMPERATURE INDICATOR 

- TALKBACK 

- TO BE DETERMINED 

- TRANSMIT COMMAND SYNC 

- TEST CALL SUPERVISOR 

- TEST CONTROL SUPERVISOR SEQUENCE PROCESSOR 

“ TEST CONTROL SUPERVISOR SINGLE COMMAND PROCESSOR 
TEMPERATURE'-CONTROLLED VOLTAGE REGULATORS 
“ TRANSMIT DATA LONG t FORMAT) 

- TRACKING AND DATA RELAY SATELLITE 

" TRACKING AND DATA RELAY SATELLITE SYSTEM 
“ TRANSMIT DATA SHORT (FORMAT) 

- TELEMETRY FORMAT LOAD 
" TOTAL FIELD OF VIEW 

-- TELEMETRY FORMAT SELECTION 

- INTERWORD GAP TIME (?) 

- TRANSLATIONAL HAND CONTROLLER 

- TIME HOMOGENEOUS DATA SET CONTROL/BUFFER TABLE 
“ TIME 'HOMOGENEOUS DATA SET CROSS REFERENCE TABLE 

- TEST ’INTERFACE CONTROL MODULE 

^ TELEMETRY . . 

- TIME MANAGEMENT PROCESSOR 
TIMEOUT 

- TEST OPERATIONS CENTER 

- TIMER QUEUE ELEMENT 

- TRANSHITTER/RECEIVER 

-TRANSFER , 

“ TEST REQUIREMENTS SPECIFICATION DOCUMENT' . - - 

- TRiSTATE REGISTER ENABLE NOT SIGNAL FROM MIA TO LRU 
“ TEST SOFTWARE PACKAGE 

- TRANSlSTOR/TRANSiSTDR LOGIC 
TELETYPEWRITER 

- TELEVISION 

- THRUST VECTOR CONTROL 

- THRUST VECTOR CONTROL DRIVER 

- USER-WRITTEN CONTROL PROGRAM 
“ UTILITY AND DATA FLOW 

- UI DOHNLiST STORAGE BUFFER 

- ULTRA-HIGH FREQUENCY 

- USER INTERFACE SOFTHARb 

- USER INTERFACE HOUULL 

- UNIVERSAL TIME COHPtNSATtU 

- UNIVERSAL TEST EuUl<*MENT 
“ UNIVERSAL T)Mt I 


V 

VlO 

Vui> 

VuMCH 

VKEF 

Viil 

rf/Pi 

W AT 

Hl^l> 

KbhUH 

WL#AL 

Wlx 

HONG 

WOW 

WK 

wsc 

AUDSN 

XFbR 

XMT 

YALW 

5hMXX 


- VALIDITY l-LAG (IN RUU) 

- VOLIAGb-CONlKOLLtiJ DSCiLLAtUK 

- VEHICLE DYNAMIC SlHULATuR SYSTEM 

" VEnTICAL gyro HiSALibNHENT COHPtNSATiaN MODULE 
“ VULTAGE REFtRENCb 

- VERTICAL SPtEU iNUiCATOK 
(UR 2)- WAY POINT I (Uk Z) 

- WAIT 

- WlDfc BAND 

- WlUt bAND FkEwuENCY UIV1;>LUN MULTIPLEXER 

- WHEELS DOWN AND LOCKED 

- WAU PUR INUEX INSTRUCTION 

- WEIGHT UN NOSH GEAR 

- WEIGHT ON Wheels 

- WORKING REGlSTtk 

~ WIDE EAND SIGNAL CONDI TIUKER 
“ TRANSMIT OISAulE OlSLRtTL 

- TkANSPER 

- 1RANSM1TTEK 

YAW AXIS CONTROL HODULt 

- HibH SPEEO SNb-tOO TTL ClkuUITS 

“ standard spcEd sns^oo itl circuits 

" HIGHEST SPEED SNS^tuu TTL ClKCUXTS 
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